Hi all,
sourcetype=ontap:volume (source="volume-list-info-iter-start" OR source="volume-get-iter") | stats first(*) as * by host, name | table host, name, size-available, size-used, size-total
When I run this search, I always get the correct value for "size-available", but some (not all) volumes have a null value for "size-used" and "size-total".
It does not seem to be related to the DOT version on the NetApp as I have another NetApp pair running the same version which does not exhibit this behaviour.
TIA
iain001
sz_free
and storage_used_percent
fields are always present, so sz_used
and sz_total
can be calculated:
sourcetype=ontap:volume (source="volume-list-info-iter-start" OR source="volume-get-iter") | `CoalesceVolumeFields` | eval na_gb_used=`BytesToGigaBytes(sz_used)` | eval gb_free=`BytesToGigaBytes(sz_free)` | eval na_gb_total=`BytesToGigaBytes(sz_total)` | eval calc_total=100 * (sz_free / (100 - storage_used_percent)) | eval calc_gb_total=`BytesToGigaBytes(calc_total)` | eval calc_gb_used=calc_gb_total - gb_free | eval gb_total=if(na_gb_total == "Null", calc_gb_total, na_gb_total) | eval gb_used=if(na_gb_used == "Null", calc_gb_used, na_gb_used) | stats first(*) as * by host, name | table host, name, gb_free, gb_used, gb_total | stats sum(*) as * by host | eval percent_used=round(100*gb_used/gb_total,1)
Hi @iain001
If you're officially answering your question, don't forget to Accept it to resolve the post.