Splunk Alert for disk space usage

[shakeel253]

I have a query that monitors DiskSpace usage and sends out alert if the diskspace goes up more then 80 percent. My Splunk account has a limit on realtime alert and i have more then 1 mongo servers so I tried using host "mongo*" since they are Mongo1, mongo2 ..
so this way I have just 1 alert for all the mongo server.

The alert works corrects but I get lot of emails about different servers.; I need a configuration or a query where I get just 1 alert which shows all the mongo servers that surpass 80 percent threshold instead of 10 different email.

Can someone help???

below is the query that I am using

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80

[rphillips_splun · Accepted solution]

You can run a search and output it to a table with whatever fields you want to display and alert on

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80 | table host Filesystem Type Size Used Avail UsePct MountedOn

When you save this search as an alert set your trigger conditions to:
- Number of Results is greater than 0
- Trigger Once

[shakeel253]

thank you the query worked