https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387748#M172092 <P>Oh, that's why......<BR /> My main language isn't English, I got you wrong.</P> <P>Let me check the relevant fields.......</P> <P>Thank you very much</P> Tue, 02 Apr 2019 12:16:02 GMT leov123 2019-04-02T12:16:02Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387742#M172086 <P>Please tell me know how can I get UsePct data?</P> <P>I must get the UsePct data which the MountedOn="/tmp" . Already type like below:</P> <P>index=* sourcetype=df MountedOn="/tmp"<BR /> |table host,UsePct</P> <P>But that hav't any result of UsePct.<BR /> Please help me.</P> <P>I try type like below, but still not good..........</P> <P>index=* source=df "/tmp"<BR /> | multikv fields Filesystem Avail UsePct<BR /> | table host,UsePct</P> <P>Please.......help me....</P> Tue, 02 Apr 2019 09:17:48 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387742#M172086 leov123 2019-04-02T09:17:48Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387743#M172087 <P>are you using the Nix TA?</P> Tue, 02 Apr 2019 10:55:31 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387743#M172087 adonio 2019-04-02T10:55:31Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387744#M172088 <P>yes....but the linux...</P> <P>Could you help me?</P> <P>It's driving me nuts...........</P> Tue, 02 Apr 2019 11:22:38 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387744#M172088 leov123 2019-04-02T11:22:38Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387745#M172089 <P>you can use either fields <CODE>Mount</CODE> or <CODE>MountedOn</CODE> and then use the <CODE>PercentUsedSpace</CODE> or <CODE>PercentFreeSpace</CODE> fields<BR /> verify you have them and so something like this:<BR /> <CODE>index=os sourcetype=df MountedOn="\tmp" | stats latest(PercentFreeSpace) as last_free Avg(PercentFreeSpace) as avg_free ... by host</CODE></P> Tue, 02 Apr 2019 11:31:28 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387745#M172089 adonio 2019-04-02T11:31:28Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387746#M172090 <P>Thank you for your answer.</P> <P>But when I use Mounted or Mount in the Search </P> <P>the result of Events and Statistics is "No results found. Try expanding the time range. "</P> <P>However, only type in <BR /> index=* sourcetype=df "tmp"<BR /> I can get some data of the result</P> <P>Finally...I type like below</P> <P>index=* sourcetype=df "/tmp"<BR /> | stats latest(PercentUsedSpace) as last_free Avg(PercentUsedSpace) as avg_free by host<BR /> | table host,last_free,avg_free</P> <P>But the last_free and avg_free in table of Statistics still empty.........</P> Tue, 29 Sep 2020 23:55:36 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387746#M172090 leov123 2020-09-29T23:55:36Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387747#M172091 <P>do you see the relevant fields? PercentUsedSpace PercentFreeSpace</P> Tue, 02 Apr 2019 11:55:37 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387747#M172091 adonio 2019-04-02T11:55:37Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387748#M172092 <P>Oh, that's why......<BR /> My main language isn't English, I got you wrong.</P> <P>Let me check the relevant fields.......</P> <P>Thank you very much</P> Tue, 02 Apr 2019 12:16:02 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-UsePct/m-p/387748#M172092 leov123 2019-04-02T12:16:02Z