I have a query that monitors DiskSpace usage and sends out alert if the diskspace goes up more then 80 percent. My Splunk account has a limit on realtime alert and i have more then 1 mongo servers so I tried using host "mongo*" since they are Mongo1, mongo2 ..
so this way I have just 1 alert for all the mongo server.
The alert works corrects but I get lot of emails about different servers.; I need a configuration or a query where I get just 1 alert which shows all the mongo servers that surpass 80 percent threshold instead of 10 different email.
Can someone help???
below is the query that I am using
host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80