Indexer disk space monitoring

[mburgess97]

Does anyone have SPL to monitor for capacity % on an index cluster?

I'd like to watch each indexer/data volume and receive an alert if they breach a 90% threshold.

[_JP]

Do you know about the Distributed Management Console?

Monitoring Splunk Enterprise overview - Splunk Documentation

You could peek into the dashboards/queries in there for help on building the SPL.  Also, there might be some alerts you can turn on.

Run DMC for the win.

[isoutamo]

Hi

as @_JP said, MC is just for monitoring the whole Splunk environment. You really need it in any distributed environment. There are also some usable apps in splunkbase.splunk.com which you could look e.g. AdminAlerts.

One way to avoid running out of disc space on indexers it migrate your environment to use volumes instead of use SPLUNK_DB on all index configurations. That way splunk automatic frozen needed data based on volume size instead of days or index sizes.

r. Ismo