topic All Disk Drives in WIndows, One Chart, From Perfmon Data in Splunk Search https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25600#M4856 <P>I'd like to have one column chart showing the percentage of drive space taken on each of the drives in the screenshot. I wouldn't want "_total", but I would want the other 3. </P> <P>How would I accomplish this?</P> <P>Thanks!</P> <P><IMG src="http://splunk-base.splunk.com//storage/perfmon-disk_1.gif" alt="alt text" /></P> Fri, 08 Feb 2013 16:11:15 GMT aferone 2013-02-08T16:11:15Z All Disk Drives in WIndows, One Chart, From Perfmon Data https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25600#M4856 <P>I'd like to have one column chart showing the percentage of drive space taken on each of the drives in the screenshot. I wouldn't want "_total", but I would want the other 3. </P> <P>How would I accomplish this?</P> <P>Thanks!</P> <P><IMG src="http://splunk-base.splunk.com//storage/perfmon-disk_1.gif" alt="alt text" /></P> Fri, 08 Feb 2013 16:11:15 GMT https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25600#M4856 aferone 2013-02-08T16:11:15Z Re: All Disk Drives in WIndows, One Chart, From Perfmon Data https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25601#M4857 <P>Something like this?</P> <PRE><CODE>source="Perform:FOO" instance!="_Total" | chart latest(Value) by instance </CODE></PRE> Fri, 08 Feb 2013 22:36:59 GMT https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25601#M4857 martin_mueller 2013-02-08T22:36:59Z Re: All Disk Drives in WIndows, One Chart, From Perfmon Data https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25602#M4858 <P>That does work, but now I get a chart for every instance of the log, let's say for the past 24 hours. How do I force it to only show one "set" of numbers?</P> Wed, 13 Feb 2013 20:12:49 GMT https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25602#M4858 aferone 2013-02-13T20:12:49Z Re: All Disk Drives in WIndows, One Chart, From Perfmon Data https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25603#M4859 <P>This s what I mean...</P> <P><IMG src="http://splunk-base.splunk.com//storage/chart.gif" alt="alt text" /></P> Wed, 13 Feb 2013 20:13:19 GMT https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25603#M4859 aferone 2013-02-13T20:13:19Z Re: All Disk Drives in WIndows, One Chart, From Perfmon Data https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25604#M4860 <P>If you want only one instance in the result you could add a filter by instance to the initial search.</P> Thu, 14 Feb 2013 09:47:10 GMT https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25604#M4860 martin_mueller 2013-02-14T09:47:10Z Re: All Disk Drives in WIndows, One Chart, From Perfmon Data https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25605#M4861 <P>Not sure I understand. Can you clarify?</P> Thu, 14 Feb 2013 15:15:15 GMT https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25605#M4861 aferone 2013-02-14T15:15:15Z Re: All Disk Drives in WIndows, One Chart, From Perfmon Data https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25606#M4862 <P>If you only want to see "C:" for example you can add instance="C:" to the search query.</P> Thu, 14 Feb 2013 15:17:09 GMT https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25606#M4862 martin_mueller 2013-02-14T15:17:09Z Re: All Disk Drives in WIndows, One Chart, From Perfmon Data https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25607#M4863 <P>Oh, yeah. What I mean, however, is I want to be able to only see one instance of the SET of drives. 3 bars total in this case, for C:, D:, and E:.</P> Thu, 14 Feb 2013 19:06:27 GMT https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25607#M4863 aferone 2013-02-14T19:06:27Z Re: All Disk Drives in WIndows, One Chart, From Perfmon Data https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25608#M4864 <P>I see. In that case, go back to my original answer (minus the typo):</P> <PRE><CODE>source="Perfmon:FOO" instance!="_Total" | chart latest(Value) by instance </CODE></PRE> Thu, 14 Feb 2013 22:04:52 GMT https://community.splunk.com/t5/Splunk-Search/All-Disk-Drives-in-WIndows-One-Chart-From-Perfmon-Data/m-p/25608#M4864 martin_mueller 2013-02-14T22:04:52Z