topic Re: Pie chart syntax for disk use in Splunk Search

Pie chart syntax for disk use

fsrodriguez — Tue, 12 Dec 2017 16:04:54 GMT

I have the values I just don't have the syntax.

host="app-1" source="df" | stats max(storage_used) as storage_used by host

Where do I include: max(TotalMBytes)?

Not sure how to convert that into a pie chart.

Re: Pie chart syntax for disk use

micahkemp — Tue, 12 Dec 2017 17:01:17 GMT

A pie chart is only going to work with one value broken out by label, and needs to be split by that label. Try something like:

host="app-1" source="df" | timechart max(storage_used) BY filesystem

Re: Pie chart syntax for disk use

kamlesh_vaghela — Tue, 12 Dec 2017 17:20:54 GMT

HI @fsrodriguez,

With your provided search I think you are looking for like below search.

host="app-1" source="df" 
| stats max(storage_used) as storage_used max(TotalMBytes) as TotalMBytes
| eval storage_unused=(TotalMBytes-storage_used) 
| table storage_used storage_unused 
| transpose

Convert viz to a pie chart. Bytes to GB is pending in this search.

Another thing I'm guessing you want the latest status of disk volume of the particular host. So can you please try the search?

host="app-1" source="df" | head 1 |
| eval storage_unused=(TotalMBytes-storage_used) 
| table storage_used storage_unused 
| transpose

Convert viz to a pie chart. Bytes to GB is pending in this search.

Thanks

Re: Pie chart syntax for disk use

fsrodriguez — Tue, 12 Dec 2017 18:13:07 GMT

wow that looks awesome! Thank you soo much! I appreciate the help!