I ran below script, but it is not working.
sourcetype=df | multikv | dedup host,Filesystem | rex field=UsePct "(?\d+)" | where usage>50 | eval _raw="Filesystem "+Filesystem+" (mount point "+MountedOn+") on host "+host+" is "+UsePct+" full!" | fields - *
Without a better explanation of "it is not working" it's hard to say exactly what is wrong, but I see a couple of problems with your search. Try this version:
sourcetype=df | multikv | dedup host,Filesystem | rex field=UsePct "(?<usage>\d+)" | where usage>50 | eval _raw="Filesystem "+Filesystem+" (mount point "+MountedOn+") on host "+host+" is "+UsePct+" full!"
Without a better explanation of "it is not working" it's hard to say exactly what is wrong, but I see a couple of problems with your search. Try this version:
sourcetype=df | multikv | dedup host,Filesystem | rex field=UsePct "(?<usage>\d+)" | where usage>50 | eval _raw="Filesystem "+Filesystem+" (mount point "+MountedOn+") on host "+host+" is "+UsePct+" full!"
Thank you I got it now...