Monitoring Splunk

Splunk Alert for disk space usage

shakeel253
Explorer

I have a query that monitors DiskSpace usage and sends out alert if the diskspace goes up more then 80 percent. My Splunk account has a limit on realtime alert and i have more then 1 mongo servers so I tried using host "mongo*" since they are Mongo1, mongo2 ..
so this way I have just 1 alert for all the mongo server.

The alert works corrects but I get lot of emails about different servers.; I need a configuration or a query where I get just 1 alert which shows all the mongo servers that surpass 80 percent threshold instead of 10 different email.

Can someone help???

below is the query that I am using

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80
1 Solution

rphillips_splun
Splunk Employee
Splunk Employee

You can run a search and output it to a table with whatever fields you want to display and alert on

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80 | table host Filesystem Type Size Used Avail UsePct MountedOn

When you save this search as an alert set your trigger conditions to:
- Number of Results is greater than 0
- Trigger Once

View solution in original post

rphillips_splun
Splunk Employee
Splunk Employee

You can run a search and output it to a table with whatever fields you want to display and alert on

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80 | table host Filesystem Type Size Used Avail UsePct MountedOn

When you save this search as an alert set your trigger conditions to:
- Number of Results is greater than 0
- Trigger Once

View solution in original post

shakeel253
Explorer

thank you the query worked

0 Karma