https://community.splunk.com/t5/Splunk-Search/Help-with-a-search-language-that-could-determine-full-disks-and/m-p/502192#M139781 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/31275">@essibong1</a>,<BR /> did you already take the information on disks from your servers using TA_Windows and TA_nix or not?<BR /> If not, you have to install these TAs or enable the stanzas to read disks.</P> <P>Then you have to run something like this for windows:</P> <PRE><CODE>index=windows sourcetype=WinHostMon DriveType=fixed | stats latest(TotalSpaceKB) AS TotalSpaceKB latest(FreeSpaceKB) AS FreeSpaceKB by host, Name | eval Perc=(FreeSpaceKB/TotalSpaceKB)*100, TotalSpaceGB=TotalSpaceKB/1024/1024, FreeSpaceGB=FreeSpaceKB/1024/1024, host=upper(host) | sort host | table Name TotalSpaceGB FreeSpaceGB Perc | rename host AS "Server Name" Name AS "Drive" Perc AS "FreeSpace%" </CODE></PRE> <P>and for Linux</P> <PRE><CODE>index=os sourcetype=hardware | dedup host | eval host=upper(host) | table HARD_DRIVES fd0 hdc sda | rename HARD_DRIVES AS "Hard Disks" fd0 AS "Floppy Disk" hdc AS "Hard Disk" sda AS "Virtual disk" </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Wed, 30 Sep 2020 03:12:07 GMT gcusello 2020-09-30T03:12:07Z https://community.splunk.com/t5/Splunk-Search/Help-with-a-search-language-that-could-determine-full-disks-and/m-p/502191#M139780 <P>Can any one help with a search language that could determine full disks and system logins after core hours?</P> Fri, 06 Dec 2019 12:34:35 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-a-search-language-that-could-determine-full-disks-and/m-p/502191#M139780 essibong1 2019-12-06T12:34:35Z https://community.splunk.com/t5/Splunk-Search/Help-with-a-search-language-that-could-determine-full-disks-and/m-p/502192#M139781 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/31275">@essibong1</a>,<BR /> did you already take the information on disks from your servers using TA_Windows and TA_nix or not?<BR /> If not, you have to install these TAs or enable the stanzas to read disks.</P> <P>Then you have to run something like this for windows:</P> <PRE><CODE>index=windows sourcetype=WinHostMon DriveType=fixed | stats latest(TotalSpaceKB) AS TotalSpaceKB latest(FreeSpaceKB) AS FreeSpaceKB by host, Name | eval Perc=(FreeSpaceKB/TotalSpaceKB)*100, TotalSpaceGB=TotalSpaceKB/1024/1024, FreeSpaceGB=FreeSpaceKB/1024/1024, host=upper(host) | sort host | table Name TotalSpaceGB FreeSpaceGB Perc | rename host AS "Server Name" Name AS "Drive" Perc AS "FreeSpace%" </CODE></PRE> <P>and for Linux</P> <PRE><CODE>index=os sourcetype=hardware | dedup host | eval host=upper(host) | table HARD_DRIVES fd0 hdc sda | rename HARD_DRIVES AS "Hard Disks" fd0 AS "Floppy Disk" hdc AS "Hard Disk" sda AS "Virtual disk" </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Wed, 30 Sep 2020 03:12:07 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-a-search-language-that-could-determine-full-disks-and/m-p/502192#M139781 gcusello 2020-09-30T03:12:07Z