All Apps and Add-ons

How to get the missing eventtype hostmon_windows in Splunk to generate the disk usage report for our host?

kkossery
Communicator

I wanted a disk report of my Windows systems and ran the following search,

eventtype=hostmon_windows Type=Disk host="*" FileSystem="*" DriveType="*" | dedup host, Name | eval FreeSpacePct=round(FreeSpaceKB/TotalSpaceKB*100) | eval TotalSpaceGB=round(TotalSpaceKB/1024/1024) | eval FreeSpaceGB=round(FreeSpaceKB/1024/1024) | search FreeSpacePct="*" TotalSpaceGB="*" | dedup host, Name, DriveType, TotalSpaceGB, FreeSpaceGB, FreeSpacePct | table host, Name, DriveType, TotalSpaceGB, FreeSpaceGB, FreeSpacePct

The search doesn't give any result. I checked if the eventtype exists by just putting,

eventtype=hostmon_windows

and this fails as well which means the eventtype doesn't exist in Splunk. How can I make sure this does and get Splunk to generate the disk usage report of our hosts.

1 Solution

jbouch03
Path Finder

It's packaged as part of Splunk_TA_windows. Did you load the TA correctly, and add the stanza to the local/inputs.conf file in Splunk_TA_windows?

View solution in original post

jbouch03
Path Finder

It's packaged as part of Splunk_TA_windows. Did you load the TA correctly, and add the stanza to the local/inputs.conf file in Splunk_TA_windows?

kkossery
Communicator

what is the block of code that has to be added to inputs.conf.
need to verify this

0 Karma

jbouch03
Path Finder

It looks like it comes from any stanza starting with [WinHostMon://]. I use [WinHostMon://disk] [WinHostMon://computer] and [WinHostMon://service] to create the eventtype. However, your original query states that you are specifically looking for the type disk, so here is my disk stanza:
[WinHostMon://disk]
type=disk
interval=300

kkossery
Communicator

Thanks! That worked.
I didn't have this entry on my inputs.conf.

0 Karma

jbouch03
Path Finder

Not a problem...remember to set your interval time accordingly. 300 is 5 minutes, but you probably won't need that much in your report. The higher the interval time the less license you will eat up during the day.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...