Splunk Search

how to edit my search to set an alert when disk usage is 60% and above?

vijaykumartcs
Explorer

There are c/d/e/f/p disk in servers, i want to set alert for the servers whose drive utilization is 60% and above..

i'm using

index=xyz sourcetype=abc host= OR host= disk=* | stats avg(diskused) as DiskUsage by host |where Diskusage > 60

but in result its not showing the disk,...
its giving
host and Diskusage info..

i need "host" "Disk(c:/D:/E:/F:/P:)" and Diskusage information in stats..

please help..

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

You need to add "disk" into your search too.

index=xyz sourcetype=abc host= OR host= disk=* | stats avg(diskused) as DiskUsage by host, disk |where Diskusage > 60

Give that a try and see if it's better. T

Though do you want the avg() of how much is used or the max() that was used? You could also check into latest() to get the latest value of it. There are lots of stats functions available.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi vijaykumartcs,
have you seen Splunk Distributed Monitoring Console?
in the default alerts there is the "DMC Alert - Near Critical Disk Usage" that probably can guide you to solve your problem, something like this:

index=xyz sourcetype=abc host= OR host= disk=*
| eval free = if(isnotnull(available), available, free) 
| eval usage = capacity - free 
| eval pct_usage = floor(usage / capacity * 100) 
| where pct_usage > 60 
| stats first(fs_type) as fs_type first(capacity) AS capacity first(usage) AS usage first(pct_usage) AS pct_usage by splunk_server, mount_point 
| eval usage = round(usage / 1024, 2) 
| eval capacity = round(capacity / 1024, 2) 
| rename splunk_server AS Instance mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

Bye.
Giuseppe

0 Karma

Richfez
SplunkTrust
SplunkTrust

You need to add "disk" into your search too.

index=xyz sourcetype=abc host= OR host= disk=* | stats avg(diskused) as DiskUsage by host, disk |where Diskusage > 60

Give that a try and see if it's better. T

Though do you want the avg() of how much is used or the max() that was used? You could also check into latest() to get the latest value of it. There are lots of stats functions available.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...