topic Re: Display disk space usage in chart format in Splunk Search

Display disk space usage in chart format

manderson7 — Mon, 29 Jun 2015 15:06:22 GMT

I am able to display disk space via the Pie Chart visualization, but I'd like to display w/ a chart, like what's in this vmware dashboard:
http://blogs.splunk.com/wp-content/uploads/2012/06/splunkx_dash_02.jpg

host=host sourcetype="df" "/dev/sda2" | dedup host | chart

I think that's how I want to start, but don't know how to finish. Thanks much for any help.

Re: Display disk space usage in chart format

woodcock — Mon, 29 Jun 2015 15:46:50 GMT

Like this?

host=host sourcetype="df" "/dev/sda2" | dedup host | table *

Re: Display disk space usage in chart format

manderson7 — Mon, 29 Jun 2015 17:00:51 GMT

Just about. That shows all the values for a df in the chart, which granted, is what I asked for. I guess what I'd really like to see is, on a scale of 100%, the used percentage of, say, /dev/sda2. I'm hoping to add multiple hosts to this query, and display each w/ a different color on the graph.
Thank you very much for your reply and assistance.

edit: I tried host=host sourcetype="df" "/dev/sda2" | dedup host | table PercentUsedSpace, which shows the correct value in statistics, but nothing in Visualization.

Re: Display disk space usage in chart format

woodcock — Mon, 29 Jun 2015 17:36:10 GMT

Based on your last comment to my first answer, do this:

 host=host sourcetype="df" "/dev/sda2" | dedup host | chart avg(PercentUsedSpace) by host

When you use table it tells Splunk not to attempt a visualization whereas chart implies a visualization and tells Splunk to attempt to do so.