How do you create an alert for disk usage?

[maryamchar]

Hello,
Is there a way to have a query in a dashboard that sends me notification when the storage space reaches a certain amount such as 70 % of storage used?

I know there is a way in the setting to enable that by going to Monitor console and alert setup -> DMC alert -> near critical disk usage. But i want to have a query instead in a dashboard that sends me an alarm too.

I'm using Splunk Enterprise search and reporting.

Thank you in advance!

[twh1]

Hi @maryamchar ,
You can use the below query to set-up the alert.

index=foo "search string"  | where stoarge_field > 70

[maryamchar]

Thank you! It didn't work for me even when i changed the % from 70 to 20

[skoelpin]

If you want the alert then why not just grab the SPL from the DMC and create an alert off it?

[maryamchar]

Because that's part of setting it didn't show me the SPL. So i'm trying to write an SPL like the DMC and create alert. Is there any easy other way ?? Thank you!

[skoelpin]

Here ya go. You just need to include your host value

(index=_introspection sourcetype=splunk_disk_objects component=Partitions "data.mount_point"="/opt/splunk" host=<YOUR HOST> ) 
| eval free=if(isnotnull('data.available'),'data.available','data.free'), usage=round((('data.capacity' - free) / 1024),2), capacity=round(('data.capacity' / 1024),2) 
| timechart minspan=10min latest(capacity) as Capacity Median(usage) as Usage

[maryamchar]

Thank you! it did not show any results 😞 is there another way to check ?

[skoelpin]

Did you change host=<YOUR HOST> to your host value?

It works on my end when I change it to a host in my env

[maryamchar]

Yes i did change it to my host and still didn't give me any results. Thank you for help

[avoelk]

this is an old topic but, for everyone who is searching for this, there are two possible reasons why this search doesn't function:

- difference in mount_point

- forgot to put in a host value

for me it was both. it works

[skoelpin]

Post your query...