Hi All , I have tried the above but still am not getting logical disk data .Shall i enable (disable=0 ) in wmi.conf to get the logical disk data ?whether both the function are same ? Usually disabled in favor of Perfmon counters [WMI:FreeDiskSpace] interval = 120 wql = SELECT Name,FreeMegabytes,PercentFreeSpace FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk index = perfmon disabled = 1 [WMI:LogicalDisk] interval = 120 wql = SELECT Name,AvgDisksecPerRead,AvgDisksecPerWrite,AvgDisksecPerTransfer,DiskReadsPersec,DiskWritesPersec FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk index = perfmon disabled = 1 [WMI:LocalPhysicalDisk] interval = 10 wql = SELECT Name, CurrentDiskQueueLength, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime FROM Win32_PerfFormattedData_PerfDisk_PhysicalDisk index = perfmon disabled = 1 ... View more

Hi Guilhem , Greetings ... thanks for your reply... I am able to get data for the below [perfmon://CPU Load] [perfmon://Network Interface] [perfmon://Available Memory]. Here is the sample output for cpu load . 07/20/2017 16:41:33.593 +0200 collection="CPU Load" object=Processor counter="% User Time" instance=_Total Value=3.4320712845436461 Problem i s am not getting data only for logicaldisk .Any suggestions ? ... View more

teunlaan , issue has been fixed by adding san attribute and cn in certiifcate ... View more

teunlaan , issue has been fixed by adding san attribute and cn in certiifcate ... View more

is there any fix for this ?can you please help ... View more

Hi mwong, Thanks for your comments and reply .Issue has been fixed after changing the alerts to scheduled and sharing tab option in alerts tab to app . ... View more

Hi Adonio , Thanks for your comments and reply .Issue has been fixed after changing the alerts to scheduled and sharing tab option in alerts tab to app . ... View more

Hi Adonio and mwong , Thanks for your comments and reply . Issue has been fixed after changing the alerts to schedule and sharing option in alert tab to app ... View more

Hi Adonio, I have now scheduled the alerts through cron and i am getting below log results and mail is still not triggered.anything i am missing here ? 04-28-2017 08:45:02.910 +0200 INFO SavedSplunker - savedsearch_id="nobody;BpServiceStatus;serv_sched_alert", user="admin", app="BpServiceStatus", savedsearch_name="secc4069_sched_alert", status=success, digest_mode=1, scheduled_time=1493361900, window_time=0, dispatch_time=1493361901, run_time=0.940, result_count=0, alert_actions="", sid="scheduler_adminBpServiceStatus_RMD5b4b50b150fb545cc_at_1493361900_82118", suppressed=0, thread_id="AlertNotifierWorker-0" ... View more

thank you so much Adonio :-):-)let me take a look into document and get back to you for queries incase !! ... View more

sure .. will read the document .. but one more query ..if i reconfigure the 37 alerts into scheduled whether it will overload the system ??? ... View more

Adonio, thank you ... yes i could see all of them skipped :'( any solution to this ? ... View more

Hi Niketnilay , Currently am getting log message as "reason="maxconcurrent limit reached" .. Any help would be greatly appreciated ... View more

Hi Niketnilay , thanks for the response. Currently i created the alerts using admin user/role . Below are the settings in splunk for admin role . User-level concurrent real-time search job limits-100 Role-level concurrent search jobs limit-200 Restrict time range-0 Restrict search terms-* Limit total job disk quota -10000 Do I need to change the limits ? Below is the query i have configured as alert in real time --> trigger result when number of result is greater than 1 and trigger once in one hour . index=windows sourcetype="WMI:Service" host= Name=HM* OR Name=SD* OR Name=H&M* OR Name=Board* OR Name=Salsa* status="Stopped" OR status="Stop"|dedup Name,host | rex "Description=(?P.+).*?" |table Name ,Description,status,_time,host |eval Name=upper(Name) |eval Env=case(host = "hostname", "DIT" ) |eval system=case(host = "hostname", "SDS") | convert timeformat="%H:%M:%S %Y-%m-%d" ctime(_time) |Rename Name as "SERVICE NAME" status as Status _time as Time host as "SERVER" Env as "Environment" system as "SYSTEM" I have configured 37 similar alerts like above .. does this cause issue ??? ... View more