Alerting on free space AND % free space - Windows-based systems

[jmo1]

   We are collecting perfmon information - "Free Megabytes" and "% Free Space".  All is well in the collection on these items.  We have an alerts that alerts us when free space is less than 10 "Free Megabytes".  Again, all is well.

   I now need to modify the alert to report any hosts where "Free Megabytes" is less than 10 AND "% Free Space" is than 20.  (Numbers are just an example).  I trying but haven't gotten it to work.  Here is what I have in my testing...

sourcetype="Perfmon:Free Disk Space" instance!=_Total counter="% Free Space" Value<20 [ search host=* sourcetype="Perfmon:Free Disk Space" instance!=_Total counter="Free Megabytes" Value<10000 | return host ] | table host, instance, Value

Two concerns..

1.  I need to look at all hosts all drives but not _Total (which combines)

2.  I need to alert only if "Free Megabytes" < 10 and "% Free Space" <20

Any help would be appreciated.

[richgalloway]

What does "haven't gotten it to work" mean?  Do you get errors?  If you get no results, have you confirmed there should be results?

At first glance, the query looks like it should work so you should verify you have data that meet the search criteria.

BTW, including an index name in the query will help improve performance.

[jmo1]

Spoiler

Thanks for the response. I think part of my logic is sound, but if I run the following...

sourcetype="Perfmon:Free Disk Space" instance!=_Total counter="% Free Space" Value>0 [ search host=* sourcetype="Perfmon:Free Disk Space" instance!=_Total counter="Free Megabytes" Value>0 | return host ] | table host, instance, Value​

Which says basically, return all hosts/drives where Free Megabytes > 0 and % Free Space >0, which should return everything.  I get the return from a single host.

How do I get it to iterate through all of the hosts?  

And thanks for the index suggestion.

[jmo1 · Accepted solution]

Answering my own question..

  In order to get it to return all hits, you need to supply a count.  So rather than

return host

I need to add a 'count'.  I used 1000 as a safe number, it doesn't appear to matter if you don't have 1000 items, so guess big.

return 1000 host