Currently I have a simple perl script set up to email me if a couple directories get above a certain quota along with a couple other warnings. That's all good but I'd like to move this monitoring into splunk. So I guess my question would be what would be the best way to do that? I tried creating a simple log with a script that is simply du -s --exclude=.* /directory >> $LOGFILE and I can get splunk to index it easy enough but I'm at a loss on what to do after that. How would I compose a search that would set up a timechart with multiple lines(each line being a monitored directory)? I've been playing with setting up different dashboards but I think I'm just missing either how to form the search query or how to set up a more sophisticated log. I've been reading through alot of the documentation and have no problem doing so, therefore if this is outlined somewhere else please point me in that direction. Also I'm using the *NIX app. ... View more

Hello, I'm new to Splunk and had a question. I've been searching for a bit and havn't found anything similar. I'm using the *NIX app and am loving it. I would like to know how to create custom views. Something I want to do is monitor the size of specific directories. I have a simple script that writes the directory size to a log every so often but I'm not sure how to turn than into one of the slick graphs I've seen in use (ex. the CPU consumption by command graph). I can index the graph and see each even but I want to interpret that information into a visual rendering eg. a graph. Is there any simple way to do this that I'm missing? Thanks ... View more