Create alert from stats value

[jrprez1804]

We have a script that pulls the disk info than the Universalforwarder reads the data and send to Splunk. With the query below I can generate a table with a clean output but now I need an alert on diskusage in above 80% utilization. In the example I would like DB1 C drive current condition to fire an triggered Splunk alert.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
dudup host | stats count by host Percent_C_FS Percent_D_FS



host         Percent_C_FS       Percent_D_FS

DB1                       15                                 75
DB2                      55                                 65

[richgalloway · Accepted solution]

Try this search. Set the alert to trigger if the result count is not zero.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
| where (Percent_C_FS < 20) OR (Percent_D_FS < 20)
dudup host | stats count by host Percent_C_FS Percent_D_FS

[jrprez1804]

Thanks that is exactly what I needed.