https://community.splunk.com/t5/Splunk-Search/How-to-search-all-mount-points-on-all-hosts-to-build-a-report-on/m-p/154067#M43292 <P>I am trying to run a search against all hosts, but I am having difficulty figuring out the right approach. A simplified version of what I am looking for is:</P> <PRE><CODE>index=os sourcetype=df host=system323 mount=/var | streamstats range(storage_used) as storage_growth window=2 </CODE></PRE> <P>But ultimately I want it to search all mount points on all hosts and then send that to a chart or a report.</P> <P>I tried a few different approaches, but none of them gave me the expected results. I felt like I was on the right path with subsearches because it felt like the equivalent of a for loop, but it did not yield the expected results</P> <PRE><CODE>index=os sourcetype=df [search index=os sourcetype=df [search index=os sourcetype=df earliest=-1d@d latest=now() | stats values(host) AS host] earliest=-1d@d latest=now() | stats values(mount) AS mount] | streamstats range(storage_used) as storage_growth window=2 </CODE></PRE> <P>How can I take my first search and build a report that will include all hosts and mount points?</P> Wed, 18 Feb 2015 11:39:16 GMT fd26645 2015-02-18T11:39:16Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-mount-points-on-all-hosts-to-build-a-report-on/m-p/154067#M43292 <P>I am trying to run a search against all hosts, but I am having difficulty figuring out the right approach. A simplified version of what I am looking for is:</P> <PRE><CODE>index=os sourcetype=df host=system323 mount=/var | streamstats range(storage_used) as storage_growth window=2 </CODE></PRE> <P>But ultimately I want it to search all mount points on all hosts and then send that to a chart or a report.</P> <P>I tried a few different approaches, but none of them gave me the expected results. I felt like I was on the right path with subsearches because it felt like the equivalent of a for loop, but it did not yield the expected results</P> <PRE><CODE>index=os sourcetype=df [search index=os sourcetype=df [search index=os sourcetype=df earliest=-1d@d latest=now() | stats values(host) AS host] earliest=-1d@d latest=now() | stats values(mount) AS mount] | streamstats range(storage_used) as storage_growth window=2 </CODE></PRE> <P>How can I take my first search and build a report that will include all hosts and mount points?</P> Wed, 18 Feb 2015 11:39:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-mount-points-on-all-hosts-to-build-a-report-on/m-p/154067#M43292 fd26645 2015-02-18T11:39:16Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-mount-points-on-all-hosts-to-build-a-report-on/m-p/154068#M43293 <P>It looks like you're interested in the changes over time so off the top of my head maybe something like:</P> <PRE><CODE>index=os sourcetype=df host=* mount=* | streamstats last(storage_used) as last_storage current=f by host,mount | eval host_mount=host.":".mount | eval delta=storage_used-last_storage | timechart sum(delta) by host_mount </CODE></PRE> Wed, 18 Feb 2015 13:14:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-mount-points-on-all-hosts-to-build-a-report-on/m-p/154068#M43293 acharlieh 2015-02-18T13:14:54Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-mount-points-on-all-hosts-to-build-a-report-on/m-p/154069#M43294 <P>Thanks for the suggestion. <CODE>by host,mount</CODE> has opened up a new world for me. But it seems like you have manually recreated what <CODE>range()</CODE> is supposed to do. Does range not work for this?</P> Wed, 18 Feb 2015 13:36:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-mount-points-on-all-hosts-to-build-a-report-on/m-p/154069#M43294 fd26645 2015-02-18T13:36:22Z https://community.splunk.com/t5/Splunk-Search/How-to-search-all-mount-points-on-all-hosts-to-build-a-report-on/m-p/154070#M43295 <P>I'll admit upfront that I haven't used <CODE>range()</CODE> before, however from the doc, it seems that range is always positive, instead of varying sign depending on if you have added or removed storage.</P> Wed, 18 Feb 2015 19:21:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-all-mount-points-on-all-hosts-to-build-a-report-on/m-p/154070#M43295 acharlieh 2015-02-18T19:21:35Z