Monitoring Splunk

Splunk Alert for disk space usage

shakeel253
Explorer

I have a query that monitors DiskSpace usage and sends out alert if the diskspace goes up more then 80 percent. My Splunk account has a limit on realtime alert and i have more then 1 mongo servers so I tried using host "mongo*" since they are Mongo1, mongo2 ..
so this way I have just 1 alert for all the mongo server.

The alert works corrects but I get lot of emails about different servers.; I need a configuration or a query where I get just 1 alert which shows all the mongo servers that surpass 80 percent threshold instead of 10 different email.

Can someone help???

below is the query that I am using

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

You can run a search and output it to a table with whatever fields you want to display and alert on

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80 | table host Filesystem Type Size Used Avail UsePct MountedOn

When you save this search as an alert set your trigger conditions to:
- Number of Results is greater than 0
- Trigger Once

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

You can run a search and output it to a table with whatever fields you want to display and alert on

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80 | table host Filesystem Type Size Used Avail UsePct MountedOn

When you save this search as an alert set your trigger conditions to:
- Number of Results is greater than 0
- Trigger Once

shakeel253
Explorer

thank you the query worked

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...