Splunk Search

Create alert from stats value

jrprez1804
Path Finder

We have a script that pulls the disk info than the Universalforwarder reads the data and send to Splunk. With the query below I can generate a table with a clean output but now I need an alert on diskusage in above 80% utilization. In the example I would like DB1 C drive current condition to fire an triggered Splunk alert.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
dudup host | stats count by host Percent_C_FS Percent_D_FS



host         Percent_C_FS       Percent_D_FS

DB1                       15                                 75
DB2                      55                                 65
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this search. Set the alert to trigger if the result count is not zero.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
| where (Percent_C_FS < 20) OR (Percent_D_FS < 20)
dudup host | stats count by host Percent_C_FS Percent_D_FS
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this search. Set the alert to trigger if the result count is not zero.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
| where (Percent_C_FS < 20) OR (Percent_D_FS < 20)
dudup host | stats count by host Percent_C_FS Percent_D_FS
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

jrprez1804
Path Finder

Thanks that is exactly what I needed.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!