topic Re: Free disk space in Alerting

Free disk space

ravir_jbp — Thu, 25 Feb 2021 14:43:23 GMT

I am trying to get the free space in % for C,D and E drive. I have below events in splunk.

02/25/2021 08:22:32.272 -0600
collection=LogicalDisk
object=LogicalDisk
counter="% Free Space"
instance=E:
Value=4284.377358490566

02/25/2021 08:20:32.264 -0600
collection=LogicalDisk
object=LogicalDisk
counter="% Free Space"
instance=D:
Value=98.32841691248771

02/25/2021 08:26:32.298 -0600
collection=LogicalDisk
object=LogicalDisk
counter="% Free Space"
instance=C:
Value=43.12314853999153

I am looking for the data like

server name Drive Free space available

xyz C: 20%

xyz 😧 30%

Re: Free disk space

gcusello — Thu, 25 Feb 2021 15:01:27 GMT

Hi @ravir_jbp,

you should have also another info about your disks: the total space "TotalSpaceKB",

In this way you can calculate the percentage of free space.

I used the following search in a dashboard:

index=windows sourcetype=WinHostMon DriveType=fixed | stats latest(TotalSpaceKB) AS TotalSpaceKB latest(FreeSpaceKB) AS FreeSpaceKB by host | eval Perc=(FreeSpaceKB/TotalSpaceKB)*100, TotalSpaceGB=TotalSpaceKB/1024/1024, FreeSpaceGB=FreeSpaceKB/1024/1024 | sort host | table hostTotalSpaceGB FreeSpaceGB Perc | rename host AS "Server Name" Name AS "Drive" Perc AS "FreeSpace%"

that you could adapt to your needs.

Ciao.

Giuseppe

Re: Free disk space

scelikok — Thu, 25 Feb 2021 19:52:25 GMT

Hi @ravir_jbp,

Your first sample event seems wrong, I assume it is typo. But please try this

index=windows collection=LogicalDisk object=LogicalDisk | stats latest(Value) as value by host instance | eval value=round(value,0).% | rename instance as Drive, host as "Server Name", value as "Free space available"

Re: Free disk space

ravir_jbp — Mon, 01 Mar 2021 09:26:10 GMT

Hi scelikok,

I am getting below error while execting the script:

"Error in 'eval' command: The expression is malformed. An unexpected character is reached at '%'. The search job has failed due to an error. You may be able view the job in the Job Inspector."

Re: Free disk space

ravir_jbp — Mon, 01 Mar 2021 09:53:57 GMT

Hi gcusello,

I did not find any thing with "TotalSpaceKB" counter. But I found below one. I tried to run

index=perfmon host=XXXXXXXX sourcetype="Perfmon:LogicalDisk" counter="Free Megabytes" instance="C:" OR instance="D:" OR instance="E:" | dedup instance, host

I am getting the events but I am trying to get that in table format with total free space in GB. Currently its showing as MB. Can you help me to conver this into GB.

Time Event
3/1/21
3:45:51.000 AM
03/01/2021 03:45:51.126 -0600
collection=LogicalDisk
object=LogicalDisk
counter="Free Megabytes"
instance=E:
Value=57853
Collapse
host = XXXXX source = Perfmon:LogicalDisksourcetype = Perfmon:LogicalDisk
3/1/21
3:45:51.000 AM
03/01/2021 03:45:51.126 -0600
collection=LogicalDisk
object=LogicalDisk
counter="Free Megabytes"
instance=D:
Value=5001
Collapse
host = XXXXXXX source = Perfmon:LogicalDisksourcetype = Perfmon:LogicalDisk
3/1/21
3:45:51.000 AM
03/01/2021 03:45:51.126 -0600
collection=LogicalDisk
object=LogicalDisk
counter="Free Megabytes"
instance=C:
Value=57853
host = XXXXXX source = Perfmon:LogicalDisksourcetype = Perfmon:LogicalDisk

Re: Free disk space

gcusello — Mon, 01 Mar 2021 10:12:59 GMT

Hi @ravir_jbp,

to convert the value from MB to GB, you have to use the eval command:

| eval FreeGigabytes=Value/1024

Ciao.

Giuseppe

Re: Free disk space

ravir_jbp — Mon, 01 Mar 2021 11:59:27 GMT

Hi gcusello, THank you for prompt response. That worked for me. I have antoher doubt and I was trying to get the C: D and E drive value into table but I am getting blank results. index=perfmon host=XXXXXX sourcetype="Perfmon:LogicalDisk" counter="% Free Space" instance="C:" OR instance="D:" OR instance="E:" | dedup counter | table host counter C: E:| stats values(host), values(counter), values(C:), values(D:), values(E:) Results I am getting here: I need to get the Value there in C D E 20 Per Page Format Preview host Space C: D: E: XXXXXXX Free Megabytes XXXXXXX % Free Space

Re: Free disk space

ravir_jbp — Tue, 02 Mar 2021 08:49:17 GMT

Hi, can you please help me with this solution as well. thank you

Re: Free disk space

scelikok — Wed, 03 Mar 2021 18:59:31 GMT

Sorry about I have forgotten quotes, please try below;

index=windows collection=LogicalDisk object=LogicalDisk | stats latest(Value) as value by host instance | eval value=round(value,0)."%" | rename instance as Drive, host as "Server Name", value as "Free space available"