Book Image

Splunk 7.x Quick Start Guide

By : James H. Baxter
Book Image

Splunk 7.x Quick Start Guide

By: James H. Baxter

Overview of this book

Splunk is a leading platform and solution for collecting, searching, and extracting value from ever increasing amounts of big data - and big data is eating the world! This book covers all the crucial Splunk topics and gives you the information and examples to get the immediate job done. You will find enough insights to support further research and use Splunk to suit any business environment or situation. Splunk 7.x Quick Start Guide gives you a thorough understanding of how Splunk works. You will learn about all the critical tasks for architecting, implementing, administering, and utilizing Splunk Enterprise to collect, store, retrieve, format, analyze, and visualize machine data. You will find step-by-step examples based on real-world experience and practical use cases that are applicable to all Splunk environments. There is a careful balance between adequate coverage of all the critical topics with short but relevant deep-dives into the configuration options and steps to carry out the day-to-day tasks that matter. By the end of the book, you will be a confident and proficient Splunk architect and administrator.
Table of Contents (12 chapters)

Creating an alert

Let's build an alert that notifies us when available disk space falls below 15% of the total capacity so we can avert any issues that can be caused by running out of disk space.

First, create a search (in Search & Reporting) using a modification of the SPL we used to create the disk usage report earlier in this chapter, as shown in the following code:

| rest services/server/status/partitions-space
| eval pct_disk_free=round(available/capacity*100,2), pct_disk_used=round(100-(available/capacity*100),2)
| eval disk_capGB=round(capacity/1024, 3), disk_availGB=round(available/1024, 3), disk_usedGB = disk_capGB - disk_availGB
| where pct_disk_free <= 15
| table splunk_server disk_capGB disk_usedGB disk_availGB pct_disk_used pct_disk_free

Note the use of the where command to filter only the events where the calculated available disk space is less than or equal...