Monitoring Splunk

Splunk Alert for disk space usage

shakeel253
Explorer

I have a query that monitors DiskSpace usage and sends out alert if the diskspace goes up more then 80 percent. My Splunk account has a limit on realtime alert and i have more then 1 mongo servers so I tried using host "mongo*" since they are Mongo1, mongo2 ..
so this way I have just 1 alert for all the mongo server.

The alert works corrects but I get lot of emails about different servers.; I need a configuration or a query where I get just 1 alert which shows all the mongo servers that surpass 80 percent threshold instead of 10 different email.

Can someone help???

below is the query that I am using

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

You can run a search and output it to a table with whatever fields you want to display and alert on

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80 | table host Filesystem Type Size Used Avail UsePct MountedOn

When you save this search as an alert set your trigger conditions to:
- Number of Results is greater than 0
- Trigger Once

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

You can run a search and output it to a table with whatever fields you want to display and alert on

host="MONGO*" sourcetype=df | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | convert auto(UsePct) | where UsePct>80 | table host Filesystem Type Size Used Avail UsePct MountedOn

When you save this search as an alert set your trigger conditions to:
- Number of Results is greater than 0
- Trigger Once

shakeel253
Explorer

thank you the query worked

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...