topic How to show Disk Space in Pie Chart in Dashboards & Visualizations

How to show Disk Space in Pie Chart

sunnyparmar — Mon, 08 Jun 2015 08:21:07 GMT

I have my own PC for which I have to show the used disk space value in Pie chart on splunk.. I have something query like this where I have 2 counters. One is "Free Megabytes" and another is "% Free Space" but from where it takes the used disk space as from perfmon logs i am not able to locate used disk space value.

index=sc-perfmon sourcetype="Perfmon*" counter="Free Megabytes" OR "% Free Space" | stats count by counter

Thanks
Ankit

Re: How to show Disk Space in Pie Chart

stephanefotso — Mon, 08 Jun 2015 09:22:57 GMT

Hello! Your counter field does not include Free Space values. You must specify counter="% Free Space" in your search criteria.
Here you go!

index=sc-perfmon sourcetype="Perfmon*" (counter="Free Megabytes" OR counter="% Free Space" )| stats count by counter

Thanks

Re: How to show Disk Space in Pie Chart

lukas_loder — Mon, 28 Sep 2020 20:08:52 GMT

Hi Anik

I was doing something like this:

index=test sourcetype=WinHostMon source=disk host=$field_server$ Name="D:" | timechart eval(sum(TotalSpaceKB) / 1048576) as Total_Space, eval(sum(FreeSpaceKB) / 1048576) as Free_Space | eval consumed_space = Total_Space - Free_Space

This one just displays the D-Disk but it works fine as a Graph. With this I get one Color "Total_Space", one "Free_Space" and one "consumed_space".

Regards

Re: How to show Disk Space in Pie Chart

stephanefotso — Mon, 08 Jun 2015 09:56:05 GMT

Note. Please you have to know how to comment an answer. You was suppose to write your requirement above as a comment for my answer. Thanks

Now lets turn back.

I think you must evaluate the used space values or you can simply do somethink like this, if you just need used space values

 index=sc-perfmon sourcetype="Perfmon*" NOT (counter="Free Megabytes" OR counter="% Free Space" )| stats count as "used spaces"

with the evaluation, here you go:

 index=sc-perfmon sourcetype="Perfmon*"|eventstats count as total_space|stats count(eval(counter="Free Megabytes")) as free_megabit  count(eval(counter="% Free Space" )) as "free"|eval free_space=free_megabit +free| eval used_space=total_space - free_space|table total_space free_space used_space

Thanks

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 28 Sep 2020 20:08:54 GMT

Hi Lukas,

Thanks for replying but My query is something like this but still it is not showing the result so could you please find out where I am doing wrong?

index=sc-perfmon sourcetype="Perfmon*" source=Perfmon:FreeDiskSpace host=BWIN7136 Name="D:" | timechart eval(sum(TotalSpaceKB) / 1048576) as Total_Space, eval(sum(FreeSpaceKB) / 1048576) as Free_Space | eval consumed_space = Total_Space - Free_Space

Regards
Ankit

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 28 Sep 2020 20:08:59 GMT

thanks for the guidance but with the below given query my splunk is showing only (free space) parameter. Total space and used space it is showing blank..

index=sc-perfmon sourcetype="Perfmon*"|eventstats count as total_space|stats count(eval(counter="Free Megabytes")) as free_megabit count(eval(counter="% Free Space" )) as "free"|eval free_space=free_megabit +free| eval used_space=total_space - free_space|table total_space free_space used_space

Regards
Ankit

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 28 Sep 2020 20:09:02 GMT

Hey,

however I able to run the query by editing some fields. I am updating the query below but still total space and free space columns showing nothing. Query is -

index=sc-perfmon sourcetype="Perfmon* " source="Perfmon:FreeDiskSpace" "instance=c" | timechart eval(sum(TotalSpaceKB) / 1048576) as Total_Space, eval(sum(FreeSpaceKB) / 1048576) as Free_Space | eval consumed_space = Total_Space - Free_Space

Please tell where I am wrong??

Regards
Ankit

Re: How to show Disk Space in Pie Chart

stephanefotso — Mon, 08 Jun 2015 11:19:40 GMT

update it like this and let me know again.

 index=sc-perfmon sourcetype="Perfmon*"|stats count as total_space count(eval(counter="Free Megabytes")) as free_megabit count(eval(counter="% Free Space" )) as "free"|eval free_space=free_megabit +free| eval used_space=total_space - free_space|table total_space free_space used_space

Re: How to show Disk Space in Pie Chart

lukas_loder — Mon, 08 Jun 2015 11:40:57 GMT

Can you please send me an example of the value of your TotalSpaceKB and FreeSpaceKB?

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 08 Jun 2015 11:59:07 GMT

Hey.. now it is started showing the data on main screen but when I am going to click on (view events) under any parameter it didn't showing any data.

Regards
Ankit

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 08 Jun 2015 12:11:20 GMT

Hey stephan,

This is what when I am running query manually it is showing something like this.

index=sc-perfmon "instance=c" source="Perfmon:FreeDiskSpace"

06/08/2015 17:38:29.547 +0500
collection=FreeDiskSpace
object=LogicalDisk
counter="% Free Space"
instance=C:
Value=21.293176691178626

Regards
Ankit

Re: How to show Disk Space in Pie Chart

fdi01 — Mon, 08 Jun 2015 12:49:49 GMT

you use this search index=sc-perfmon sourcetype="Perfmon*" source=Perfmon:FreeDiskSpace host=BWIN7136 Name="D:" | timechart eval(sum(TotalSpaceKB) / 1048576) as Total_Space, eval(sum(FreeSpaceKB) / 1048576) as Free_Space | eval consumed_space = Total_Space - Free_Space

you use the fields "TotalSpaceKB" and "" FreeSpaceKB "in your Requette but I do not think these fields are in your data. exchange them with the corresponding fields in your data as they are part of the data of Mr lukas.loder

try also like this:

index=sc-perfmon sourcetype="Perfmon*"|timechart sum(eval(counter="Free Megabytes" OR counter="% Free Space")) as free_megabit  sum(eval(counter!="Free Megabytes" OR counter!="% Free Space")) as used_space

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 08 Jun 2015 12:55:59 GMT

Hey.. sorry for replying late.. when i am running the manual query that is given below it is showing the output like this.. here i have one more doubt that is do I need to mention some parameter for GB in inputs.conf file in order to show the value in GB's in splunk. My inputs.conf file conf. is given below

[perfmon://FreeDiskSpace]
counters = Free Megabytes;% Free Space
instances = *
interval = 10
object = LogicalDisk
useEnglishOnly=true
disabled = 0
index = sc-perfmon

Query
index=sc-perfmon "instance=c" source="Perfmon:FreeDiskSpace"
Output
06/08/2015 18:23:09.542 +0500
collection=FreeDiskSpace
object=LogicalDisk
counter="% Free Space"
instance=C:
Value=21.288293830994441

Regards
Ankit

Re: How to show Disk Space in Pie Chart

stephanefotso — Mon, 08 Jun 2015 13:07:16 GMT

Please let me know if you have a field called counter showing at the field side bar when you just run the search index=sc-perfmon "instance=c" source="Perfmon:FreeDiskSpace counter=*

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 08 Jun 2015 13:15:56 GMT

Yes .. I have the counter field as shown below ..

06/08/2015 18:23:09.542 +0500
collection=FreeDiskSpace
object=LogicalDisk
counter="% Free Space"
instance=C:
Value=21.288293830994441

Regards
Ankit

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 08 Jun 2015 13:25:00 GMT

Hey fdi01,

You solved my problem.. I am so dumb..didn't notice this thing.. Right now it started showing the data. Thanks a lot for your valuable input.

Regards
Ankit

Re: How to show Disk Space in Pie Chart

lukas_loder — Mon, 08 Jun 2015 13:31:50 GMT

Do you want the UsedSpace in Percent? Cauce you see there just the value in percent. And you nowhere see it in GB.

Re: How to show Disk Space in Pie Chart

stephanefotso — Mon, 08 Jun 2015 13:38:32 GMT

Please let me know again if you have events with the search bellow:

    index=sc-perfmon sourcetype="Perfmon*" counter!="Free Megabytes"  counter!= "% Free Space"

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 28 Sep 2020 20:09:08 GMT

Hey fdi,

could you please tell me with this query how to show value in GB as right now it is showing in 4 or 5 digits value.

index=sc-perfmon sourcetype="Perfmon*" "instance=c" OR "instance=d" | timechart sum(eval(counter="Free Megabytes" OR counter="% Free Space")) as free_megabit sum(eval(counter!="Free Megabytes" OR counter!="% Free Space")) as used_space

Regards
Ankit

Re: How to show Disk Space in Pie Chart

sunnyparmar — Mon, 28 Sep 2020 20:09:11 GMT

Hey,

I want to show the values in GB with this query as right now it is showing in 4 or 5 digits.

Regards
Ankit