topic Re: Getting Drive Specific Disk space information from hosts in Monitoring Splunk

Getting Drive Specific Disk space information from hosts

dar104 — Mon, 27 Feb 2012 16:09:48 GMT

I am using the universal forwarder on Windows Servers as I thought it would gather the needed information. However, it seems it only reports total disk space, _total, and not on the individual drives. Is there a way I can capture individual drives with perfmon or should I revert to WMI polling, which is a pain in our envrironment due to getting a service AD account?

If I have to switch to WMI polling is there any point in leaving the universal forwarder on the windows servers to collect information?

Any help would be appreciated.

Re: Getting Drive Specific Disk space information from hosts

Drainy — Mon, 27 Feb 2012 17:56:16 GMT

Yes!
You can get the UF to do the polling for your, assuming it is running under an account with admin permissions. I used to use a VBS script to perform the WMI query locally and the results of the query would be forwarded onto the indexer, a nice simple way to achieve what you want.

Re: Getting Drive Specific Disk space information from hosts

dar104 — Mon, 27 Feb 2012 20:39:42 GMT

All I was getting from the forwarder was total disk space % instead of individual drives. I think I figured out a solution. I am testing now. If it works I will put results here.

Thanks for the response.

Re: Getting Drive Specific Disk space information from hosts

dar104 — Fri, 02 Mar 2012 20:57:52 GMT

I found out you need to enable the counter in perfmon in the perfmon.conf file in etc/system/local on the host. I added the following and I was able to get perfmon to work.

[PERFMON:FreeDiskSpace]
counters = Free Megabytes;% Free Space
disabled = 0
instances = *
interval = 10
object = LogicalDisk

Re: Getting Drive Specific Disk space information from hosts

feickertmd — Fri, 21 Nov 2014 15:49:44 GMT

dar104,

I tried what you suggested, and I am not seeing results by drive letter. Can you contact me to discuss? I'd like to know better what to expect.

marc.feickert@optum.com

Re: Getting Drive Specific Disk space information from hosts

mark_chuman — Mon, 28 Sep 2020 18:22:08 GMT

This worked for me!

index=perfstats sourcetype=PerfmonMk* host=servername C | timechart avg("%_Free_Space") by host