Splunk Search

Create alert from stats value

jrprez1804
Path Finder

We have a script that pulls the disk info than the Universalforwarder reads the data and send to Splunk. With the query below I can generate a table with a clean output but now I need an alert on diskusage in above 80% utilization. In the example I would like DB1 C drive current condition to fire an triggered Splunk alert.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
dudup host | stats count by host Percent_C_FS Percent_D_FS



host         Percent_C_FS       Percent_D_FS

DB1                       15                                 75
DB2                      55                                 65
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this search. Set the alert to trigger if the result count is not zero.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
| where (Percent_C_FS < 20) OR (Percent_D_FS < 20)
dudup host | stats count by host Percent_C_FS Percent_D_FS
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this search. Set the alert to trigger if the result count is not zero.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
| where (Percent_C_FS < 20) OR (Percent_D_FS < 20)
dudup host | stats count by host Percent_C_FS Percent_D_FS
---
If this reply helps you, Karma would be appreciated.

jrprez1804
Path Finder

Thanks that is exactly what I needed.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...