Splunk Search

Create alert from stats value

jrprez1804
Path Finder

We have a script that pulls the disk info than the Universalforwarder reads the data and send to Splunk. With the query below I can generate a table with a clean output but now I need an alert on diskusage in above 80% utilization. In the example I would like DB1 C drive current condition to fire an triggered Splunk alert.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
dudup host | stats count by host Percent_C_FS Percent_D_FS



host         Percent_C_FS       Percent_D_FS

DB1                       15                                 75
DB2                      55                                 65
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this search. Set the alert to trigger if the result count is not zero.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
| where (Percent_C_FS < 20) OR (Percent_D_FS < 20)
dudup host | stats count by host Percent_C_FS Percent_D_FS
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this search. Set the alert to trigger if the result count is not zero.

index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" 
| rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)"
| rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)"
| where (Percent_C_FS < 20) OR (Percent_D_FS < 20)
dudup host | stats count by host Percent_C_FS Percent_D_FS
---
If this reply helps you, Karma would be appreciated.

jrprez1804
Path Finder

Thanks that is exactly what I needed.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...