topic Re: How to calculate total disk size when using freediskspace collection? in Splunk Search

How to calculate total disk size when using freediskspace collection?

edwinmae — Mon, 08 Aug 2016 07:12:34 GMT

I am searching for a 'search' that will give me the following information:
Disk usage (C:) in %
Total Disk size (C:)
Free Disk space (C:)

I know there is Windows App, but I would like to achieve this without that

index = "perfmonxx" collection = FreeDiskSpace (counter="% Free Space" OR counter="Free Megabytes") instance=C: host=xx
| eval usage=(100-Value)
| eval GB=(Value/1024)
| eval size=GB*(100/(100-usage)) 
| eval usage1=(ceiling(usage))
| eval GB1=(floor(GB)) | stats max(usage1) as Usage max(size) as Total max(GB1) as Free by host

Using this, I get the usage (in %) and the available free space (in GB) correctly, but the (manual) calculation 'for total size' doesn't show me the correct result.

When I calculate it manually (using e.g. calculator) it gives me the correct result: size = 9.x * (100 / (100 - 83.x) ~ 60 GB

But the outcome in Splunk gives me a different result. I am stuck, please advise.

Re: How to calculate total disk size when using freediskspace collection?

jkat54 — Mon, 08 Aug 2016 12:26:25 GMT

Oh dear lord forgive me for this search:

index="perfmonxxx" collection=FreeDiskSPace counter="% Free Space"  
| eval diskInfoA=mvzip(instance,Value) 
| eval diskInfoA1=mvzip(diskInfoA,counter) 
| table diskInfoA1 host instance 
| join host instance
  [
  search index="perfmonxxx" collection=FreeDiskSPace counter="Free Megabytes"
  | eval diskInfoB=mvzip(instance,Value) 
  | eval diskInfoB1=mvzip(diskInfoB,counter) 
  | table diskInfoB1 host instance 
  ]
| makemv diskInfoA1 delim=","
| makemv diskInfoB1 delim=","
| eval freePerc=mvindex(diskInfoA1,1)
| eval freeMegs=mvindex(diskInfoB1,1)
| eval usage=(ceiling(100-freePerc))
| eval GB=(floor(freeMegs/1024))
| eval totalDiskGB=(GB/(freePerc/100))
| stats max(usage) as Usage max(GB) as Free max(totalDiskGB) as diskSizeGB by host instance

Re: How to calculate total disk size when using freediskspace collection?

edwinmae — Tue, 09 Aug 2016 06:40:44 GMT

You're forgiven as it worked for me 🙂 Thanks!

Re: How to calculate total disk size when using freediskspace collection?

jkat54 — Tue, 09 Aug 2016 10:43:23 GMT

Awesome, thanks for marking as the answer and let us know if you ever need help again!

Re: How to calculate total disk size when using freediskspace collection?

bdahlb — Mon, 07 May 2018 16:14:02 GMT

So obviously this has been answered for a while, but I came across this today with the same question. Here is the same search but using "stats" instead of the "join":

index=perfmon host=* object="LogicalDisk" counter="% Free Space" OR counter="Free Megabytes"
| eval diskInfoA = if(counter=="% Free Space",mvzip(instance,Value),null())
| eval diskInfoA1 = if(isnotnull(diskInfoA),mvzip(diskInfoA,counter),null())
| eval diskInfoB = if(counter=="Free Megabytes",mvzip(instance,Value),null())
| eval diskInfoB1 = if(isnotnull(diskInfoB),mvzip(diskInfoB,counter),null())
| stats list(diskInfoA1) AS "diskInfoA1", list(diskInfoB1) AS "diskInfoB1" by host, instance, _time
| makemv diskInfoA1 delim=","
| makemv diskInfoB1 delim=","
| eval freePerc = mvindex(diskInfoA1,1)
| eval freeMB = mvindex(diskInfoB1,1)
| eval usage=round(100-freePerc,2)
| eval GB = round(freeMB/1024,2)
| eval totalDiskGB = GB/(freePerc/100)
| stats max(usage) AS "Disk Usage", max(GB) AS "Disk Free", max(totalDiskGB) AS "Total Disk Size (GB)" by host instance

Re: How to calculate total disk size when using freediskspace collection?

Ranazar — Mon, 10 Sep 2018 20:29:35 GMT

I stumbled across this post when having the same challenge. This stats-based command was really helpful - but just an FYI to future readers that neither of these searches will work if you're at 0% free space. It's not something you can fix by changing the search - it's just the inherent problem of trying to use freeMB and freePerc to figure out used or total.

It's possible that hitting 0.000...% free space is super rare - but this is still annoying to me. The problem is simply that perfmon doesn't collect used or total metrics. In my case I think I'll end up using WMI for this.