Solved: How to setup an e-mail alert in Splunk App for Uni...

sathiyasun · ‎01-26-2015

richgalloway · ‎01-26-2015

This should get you started on disk fillings. Set it up as a scheduled search that sends an email if there are results. Change the '85' to your own threshold value.

I don't have anything for memory spikes.

index="os" sourcetype="df" | multikv fields FileSystem, UsePct  | strcat host '@' Filesystem Drive| replace "*%" with "*" in UsePct | dedup Drive | table Drive IPAddress UsePct | where UsePct > 85

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎01-26-2015

This should get you started on disk fillings. Set it up as a scheduled search that sends an email if there are results. Change the '85' to your own threshold value.

I don't have anything for memory spikes.

index="os" sourcetype="df" | multikv fields FileSystem, UsePct  | strcat host '@' Filesystem Drive| replace "*%" with "*" in UsePct | dedup Drive | table Drive IPAddress UsePct | where UsePct > 85

---
If this reply helps you, Karma would be appreciated.

How to setup an e-mail alert in Splunk App for Unix and Linux for disk fillings and memory spike?

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics!

New in Observability Cloud - Explicit Bucket Histograms