https://community.splunk.com/t5/Splunk-Search/Help-on-formula/m-p/308479#M161936 <P>hi </P> <P>i use this code to monitore the hdd free space<BR /> index="perfmon" sourcetype="perfmon:logicaldisk" instance=c: counter="% Free Space" | eval Value = round(Value, 2). "%" |table _time host Value<BR /> but this code give me the free space and not the buzy space<BR /> i have 89% free so i would to have instead 11% busy<BR /> how can i do please??</P> Fri, 30 Mar 2018 09:14:07 GMT jip31 2018-03-30T09:14:07Z https://community.splunk.com/t5/Splunk-Search/Help-on-formula/m-p/308479#M161936 <P>hi </P> <P>i use this code to monitore the hdd free space<BR /> index="perfmon" sourcetype="perfmon:logicaldisk" instance=c: counter="% Free Space" | eval Value = round(Value, 2). "%" |table _time host Value<BR /> but this code give me the free space and not the buzy space<BR /> i have 89% free so i would to have instead 11% busy<BR /> how can i do please??</P> Fri, 30 Mar 2018 09:14:07 GMT https://community.splunk.com/t5/Splunk-Search/Help-on-formula/m-p/308479#M161936 jip31 2018-03-30T09:14:07Z https://community.splunk.com/t5/Splunk-Search/Help-on-formula/m-p/308480#M161937 <P>Can you try subtracting free space from 100. Like, <CODE>|eval Value=100-round(Value)</CODE></P> Fri, 30 Mar 2018 09:42:58 GMT https://community.splunk.com/t5/Splunk-Search/Help-on-formula/m-p/308480#M161937 p_gurav 2018-03-30T09:42:58Z https://community.splunk.com/t5/Splunk-Search/Help-on-formula/m-p/308481#M161938 <P>thanks it works!</P> Fri, 30 Mar 2018 09:49:10 GMT https://community.splunk.com/t5/Splunk-Search/Help-on-formula/m-p/308481#M161938 jip31 2018-03-30T09:49:10Z