Creating an alert

Let's build an alert that notifies us when available disk space falls below 15% of the total capacity so we can avert any issues that can be caused by running out of disk space.

First, create a search (in Search & Reporting) using a modification of the SPL we used to create the disk usage report earlier in this chapter, as shown in the following code:

| rest services/server/status/partitions-space
| eval pct_disk_free=round(available/capacity*100,2), pct_disk_used=round(100-(available/capacity*100),2)
| eval disk_capGB=round(capacity/1024, 3), disk_availGB=round(available/1024, 3), disk_usedGB = disk_capGB - disk_availGB
| where pct_disk_free <= 15
| table splunk_server disk_capGB disk_usedGB disk_availGB pct_disk_used pct_disk_free

Note the use of the where command to filter only the events where the calculated available disk space is less than or equal...