How to get the missing eventtype hostmon_windows in Splunk to generate the disk usage report for our host?

[kkossery]

I wanted a disk report of my Windows systems and ran the following search,

eventtype=hostmon_windows Type=Disk host="*" FileSystem="*" DriveType="*" | dedup host, Name | eval FreeSpacePct=round(FreeSpaceKB/TotalSpaceKB*100) | eval TotalSpaceGB=round(TotalSpaceKB/1024/1024) | eval FreeSpaceGB=round(FreeSpaceKB/1024/1024) | search FreeSpacePct="*" TotalSpaceGB="*" | dedup host, Name, DriveType, TotalSpaceGB, FreeSpaceGB, FreeSpacePct | table host, Name, DriveType, TotalSpaceGB, FreeSpaceGB, FreeSpacePct

The search doesn't give any result. I checked if the eventtype exists by just putting,

eventtype=hostmon_windows

and this fails as well which means the eventtype doesn't exist in Splunk. How can I make sure this does and get Splunk to generate the disk usage report of our hosts.

[jbouch03 · Accepted solution]

It's packaged as part of Splunk_TA_windows. Did you load the TA correctly, and add the stanza to the local/inputs.conf file in Splunk_TA_windows?

[kkossery]

what is the block of code that has to be added to inputs.conf.
need to verify this

[jbouch03]

It looks like it comes from any stanza starting with [WinHostMon://]. I use [WinHostMon://disk] [WinHostMon://computer] and [WinHostMon://service] to create the eventtype. However, your original query states that you are specifically looking for the type disk, so here is my disk stanza:
[WinHostMon://disk]
type=disk
interval=300

[kkossery]

Thanks! That worked.
I didn't have this entry on my inputs.conf.

[jbouch03]

Not a problem...remember to set your interval time accordingly. 300 is 5 minutes, but you probably won't need that much in your report. The higher the interval time the less license you will eat up during the day.