topic Re: Disk Usage: How to show memory consuming files? in Splunk Search

Disk Usage: How to show memory consuming files?

Gabriel — Tue, 07 Mar 2023 18:50:21 GMT

Hello everyone

Is there a way to determine what occupies disk storage?

The following SPL yields a line graph that shows disk utilization per host and each of its drives.

index=winperf_prod sourcetype=*Perfmon* storage_free_percent="*" | eval storage_used_percent=round(100-storage_free_percent,2) | eval host_dev=printf("%s:%s\\",host,instance) | timechart max(storage_used_percent) by host_dev

Now I want to determine what the drop in one of the drives cause on February 12. Ideally I get a list of all processes/files/etc. that occupy disk storage.

Help is appreciated 😃

Re: Disk Usage: How to show memory consuming files?

richgalloway — Wed, 08 Mar 2023 17:01:08 GMT

I think disk usage info isn't enough to answer the question. You need file-level data (creates, deletes, etc.) from other inputs. Perhaps you could just run du on the system with the drive in question?

Re: Disk Usage: How to show memory consuming files?

Gabriel — Thu, 09 Mar 2023 15:10:41 GMT

Thanks for the hint! Tracking the files (by means of du) would then let me understand what makes up disk usage.