Setting up Alerts for basic things like Disk Space for windows/Unix servers

[pc591f]

I'm very new to this and found we do not have any alerts setup for basic things like Disk space on drives etc, I've done some basic courses but I don't know what to put after Host= to capture all drives on both windows and Unix

• Application Crashes.
• System or Service Failures.
• Windows Update Errors.
• Windows Firewall.
• Clearing Event Logs.
• Software and Service Installation.
• Account Usage Kernel Driver Signing.

[gcusello · Accepted solution]

hi @pc591f ,

at first see in documentation how to get data in from forwarders (https://docs.splunk.com/Documentation/Splunk/9.2.1/Data/Usingforwardingagents)

then install on Forwarders one of these apps: Splunk TA for Windows (https://splunkbase.splunk.com/app/742) or Splunk TA for nix (https://splunkbase.splunk.com/app/833), remembering to enable inputs that by default are disabled.

Having those logs, youcan create your own searches.

The most difficoult is to know what to search, but this isn't a Splunk knowledge.

To understand how to create the search, you can follow the Splunk Search Tutorial  (https://docs.splunk.com/Documentation/SplunkCloud/8.1.0/SearchTutorial/WelcometotheSearchTutorial).

Ciao.

Giuseppe

[pc591f]

Hi Gcusello

Thanks for the information, Forwarders are installed on all servers currently, its just setting up the searches are my colleague is away for the week and i just trying to set up some basic alerts, thanks for your advice 

[gcusello]

Hi @pc591f,

check if the add-ons I mentioned are installed and if the inputs that takes the information you need are enabled.

If yes, you have only to create your searches.

if not, you haven't the information for your Use Cases.

Ciao.

Giuseppe