topic Re: WMI:FreeDiskSpace returns information about the CD-ROM drive on the server in Getting Data In

WMI:FreeDiskSpace returns information about the CD-ROM drive on the server

usup_rajbahak — Wed, 05 Sep 2012 21:06:44 GMT

I am using the following wmi query to gather free disk space info on a Windows 2008 R2 server. The problem I have is that the query seems to be sending information not only of the local disk on the server but also of the CD-ROM drive installed on the server.

[WMI:FreeDiskSpace]
interval = 600
wql = select Name, FreeSpace from Win32_LogicalDisk
index = default
disabled = 0

Here's the data the universal forwarder on the server is sending to Splunk, which I think is the data for the CD-ROM drive. Notice the NULL value for the FreeSpace parameter?

20120905135639.531544
FreeSpace=NULL
Name=D:
wmi_type=FreeDiskSpace
host=paul Options| sourcetype=WMI:FreeDiskSpace Options| source=WMI:FreeDiskSpace Options

How do I get the universal forwarder send the free space information data only for the actual disk drives and not the cd-rom drive?

Thanks a lot in advance.

Re: WMI:FreeDiskSpace returns information about the CD-ROM drive on the server

Drainy — Wed, 05 Sep 2012 21:12:14 GMT

You could always add a where to the end of your query, something like;

Where Name = 'C:' OR where Name = 'E:' etc, you may need to use C:\ depending on your system

Re: WMI:FreeDiskSpace returns information about the CD-ROM drive on the server

usup_rajbahak — Wed, 05 Sep 2012 21:42:01 GMT

Thanks for your prompt reply Drainy. It's working for me now :-).

But then, what if I have two logical drives?

will "Where Name = 'C:' and 'the next logical drive:'" work?

Re: WMI:FreeDiskSpace returns information about the CD-ROM drive on the server

Drainy — Thu, 06 Sep 2012 00:09:58 GMT

Sorry, it wasn't very clear, the whole statement from where to 'E:' is to allow for two Names. The OR is part of the query 🙂