Alerting

source type for disk space alert

vinay_uim
Explorer

Hi All,

I am trying to setup disk space alert for few servers but I am not getting any results with sourcetype="df".
As I am very new splunk user, could you please let me know is there any other source type available for disk space or how can I set up alert on those servers where sourcetype=df not available?

Thanks in advance.

Tags (1)
0 Karma
1 Solution

JDukeSplunk
Builder

So is it that some servers have sourcetype=df and some do not? Anyway, this should help you get your sourceytpe lists for your hosts.

Try this in like a 60 minute search on one host that is not reporting df and see if one of the others is where disk space is hiding.

index=* host=SOMELINUXHOSTNAME   |dedup sourcetype |table sourcetype 

OR..to get a list of what sourcetypes are avaliable for all hosts use this. If you know what index df should be in substitue that for index=*

index=*  | stats values(sourcetype) AS sourcetypes values(index) AS indexes by host

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

The DF source type is provided from the Splunk NIX TA, and has to be enabled in the modular inputs for this app.

This can be found here : https://splunkbase.splunk.com/app/833/

This needs to be installed on all your servers, and enabled. Most likely you will find that the servers that do not have this agent on them do not have the TA installed, or the input is not enabled, or these are NIX hosts..

0 Karma

vinay_uim
Explorer

Thanks Esix

0 Karma

JDukeSplunk
Builder

So is it that some servers have sourcetype=df and some do not? Anyway, this should help you get your sourceytpe lists for your hosts.

Try this in like a 60 minute search on one host that is not reporting df and see if one of the others is where disk space is hiding.

index=* host=SOMELINUXHOSTNAME   |dedup sourcetype |table sourcetype 

OR..to get a list of what sourcetypes are avaliable for all hosts use this. If you know what index df should be in substitue that for index=*

index=*  | stats values(sourcetype) AS sourcetypes values(index) AS indexes by host

View solution in original post

0 Karma

vinay_uim
Explorer

Thank You JDuke.
Yes, some server have sourcetype=df and some servers doesn't have. I checked using above search string few servers doesn't have sourcetype=df.

Is there any way to setup disk space alert on servers that doesn't have sourcetype=df.

0 Karma

JDukeSplunk
Builder

Esix is correct. If sourcetype=df is not avaliable on certain hosts they are not reporting df back to the index. This will require that the Splunk NIX TA app be deployed to these hosts. This can either be done manually host by host, or if you have a deployment server setup you can simply deploy the Splunk NIX TA app to the hosts that are not reporting disk space properly.

http://docs.splunk.com/Splexicon:Deploymentserver

0 Karma

vinay_uim
Explorer

Thank You

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!