topic Stacked Bar Chart - Disk Usage in Splunk Search

Stacked Bar Chart - Disk Usage

lanying — Tue, 02 Aug 2011 07:05:13 GMT

Now, I am collecting a disk space log by using a WMI.
I want to make a stacked bar chart about disk space.
How can I make a stack bar chart for Free space & Used space by driver (C: , 😧 ..)
Thanks.

Collect Command :::
[WMI:DiskSpace]
interval = 30
wql = Select Name , FreeSpace , Size From Win32_LocalDisk where DriveType=3
disabled = 0

Collected Log Data :::
20110802134951.921875
FreeSpace=35046666240
Name=C:
Size=53694595072
wmi_type=DiskSpace

Re: Stacked Bar Chart - Disk Usage

Ayn — Tue, 02 Aug 2011 07:45:44 GMT

Since used space = Size - FreeSpace, you can calculate the difference and chart it in a stacked chart where the total height of each bar will be equivalent to the total space:

<yourbasesearch>
| eval UsedSpace=Size-FreeSpace
| chart first(UsedSpace),first(FreeSpace)

Re: Stacked Bar Chart - Disk Usage

lanying — Tue, 02 Aug 2011 07:58:35 GMT

감사감사...(thank you for your help)

Re: Stacked Bar Chart - Disk Usage

Ayn — Tue, 02 Aug 2011 08:51:47 GMT

No problem. If the answer solved your problem, please mark it as 'accepted'. That way it'll be correctly labeled in the system. Thanks.

Re: Stacked Bar Chart - Disk Usage

peter_payne — Thu, 27 Oct 2011 14:07:23 GMT

Fishing...