topic Re: df by host,mount in Splunk Search

df by host,mount

cmeo — Fri, 10 Jan 2014 05:49:25 GMT

I'm trying to set up a timechart of disk free by host and mountpoint and this is proving difficult, because timechart will only accept one field for a by clause. This doesn't work because the level of uniqueness is host,mount not host or mount. Let me additionally say I loathed the new version of the NIX app on sight and can't stand the new visualisations. The old versions--which I can't download any more for pointers--did the job fine in my opinion. So all I want is for something like this to work:

sourcetype=df| timechart span=1h avg(storage_percent_free) AS pctfree by host, mount

and make a nice, old school line chart which you can extrapolate easily...like the old version did.

Anyone know how I get there?

Re: df by host,mount

MuS — Fri, 10 Jan 2014 07:29:42 GMT

Hi cmeo,

you can use chart instead to do this:

 sourcetype=df | chart span=1h values(mount) AS mount avg(storage_percent_free) AS pctfree over _time by host

should do the job for you.

cheers, MuS

Re: df by host,mount

jbrodsky_splunk — Fri, 10 Jan 2014 21:41:05 GMT

Or something like this?

sourcetype=df index=os | eval hostmount=host.":".mount | timechart avg(storage_free_percent) by hostmount usenull=f