Monitoring Splunk

Create Splunk Storage (Disk Space) Capacity Alarm (Alert)

shakeel253
Explorer

The OS I am currently using is Redhat, i need help with the query that sends an alert if the DiskSpace goes over 70 percent

host="MONGO" sourcetype=df

1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this search. Schedule it to run at some interval (hourly, for example). Set the alert to trigger when the number of results is not zero.

host="MONGO" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>95
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this search. Schedule it to run at some interval (hourly, for example). Set the alert to trigger when the number of results is not zero.

host="MONGO" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>95
---
If this reply helps you, Karma would be appreciated.

kiril123
Path Finder

Go to Settings -> Monitoring console -> Settings -> Alerts Setup. Then select and configure the following:

DMC Alert - Near Critical Disk Usage

0 Karma

shakeel253
Explorer

thank you for the response, but i need a Splunk Query which can be changed to Alert

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...