All Apps and Add-ons

How to get the missing eventtype hostmon_windows in Splunk to generate the disk usage report for our host?

kkossery
Communicator

I wanted a disk report of my Windows systems and ran the following search,

eventtype=hostmon_windows Type=Disk host="*" FileSystem="*" DriveType="*" | dedup host, Name | eval FreeSpacePct=round(FreeSpaceKB/TotalSpaceKB*100) | eval TotalSpaceGB=round(TotalSpaceKB/1024/1024) | eval FreeSpaceGB=round(FreeSpaceKB/1024/1024) | search FreeSpacePct="*" TotalSpaceGB="*" | dedup host, Name, DriveType, TotalSpaceGB, FreeSpaceGB, FreeSpacePct | table host, Name, DriveType, TotalSpaceGB, FreeSpaceGB, FreeSpacePct

The search doesn't give any result. I checked if the eventtype exists by just putting,

eventtype=hostmon_windows

and this fails as well which means the eventtype doesn't exist in Splunk. How can I make sure this does and get Splunk to generate the disk usage report of our hosts.

1 Solution

jbouch03
Path Finder

It's packaged as part of Splunk_TA_windows. Did you load the TA correctly, and add the stanza to the local/inputs.conf file in Splunk_TA_windows?

View solution in original post

jbouch03
Path Finder

It's packaged as part of Splunk_TA_windows. Did you load the TA correctly, and add the stanza to the local/inputs.conf file in Splunk_TA_windows?

View solution in original post

kkossery
Communicator

what is the block of code that has to be added to inputs.conf.
need to verify this

0 Karma

jbouch03
Path Finder

It looks like it comes from any stanza starting with [WinHostMon://]. I use [WinHostMon://disk] [WinHostMon://computer] and [WinHostMon://service] to create the eventtype. However, your original query states that you are specifically looking for the type disk, so here is my disk stanza:
[WinHostMon://disk]
type=disk
interval=300

kkossery
Communicator

Thanks! That worked.
I didn't have this entry on my inputs.conf.

0 Karma

jbouch03
Path Finder

Not a problem...remember to set your interval time accordingly. 300 is 5 minutes, but you probably won't need that much in your report. The higher the interval time the less license you will eat up during the day.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.