Splunk App for NetApp Data ONTAP: Why does my sourcetype=ontap:volume search return some volumes with a null value for size-used and size-total?

[iain001]

Hi all,

sourcetype=ontap:volume (source="volume-list-info-iter-start" OR source="volume-get-iter") | stats first(&#42) as &#42 by host, name | table host, name, size-available, size-used, size-total

When I run this search, I always get the correct value for "size-available", but some (not all) volumes have a null value for "size-used" and "size-total".

It does not seem to be related to the DOT version on the NetApp as I have another NetApp pair running the same version which does not exhibit this behaviour.

TIA
iain001

[iain001]

sz_free and storage_used_percent fields are always present, so sz_used and sz_total can be calculated:

sourcetype=ontap:volume (source="volume-list-info-iter-start" OR source="volume-get-iter") | `CoalesceVolumeFields` | eval na_gb_used=`BytesToGigaBytes(sz_used)` | eval gb_free=`BytesToGigaBytes(sz_free)` | eval na_gb_total=`BytesToGigaBytes(sz_total)` | eval calc_total=100 * (sz_free / (100 - storage_used_percent)) | eval calc_gb_total=`BytesToGigaBytes(calc_total)` | eval calc_gb_used=calc_gb_total - gb_free | eval gb_total=if(na_gb_total == "Null", calc_gb_total, na_gb_total) | eval gb_used=if(na_gb_used == "Null", calc_gb_used, na_gb_used) | stats first(*) as * by host, name | table host, name, gb_free, gb_used, gb_total | stats sum(*) as * by host | eval percent_used=round(100*gb_used/gb_total,1)

[ppablo]

Hi @iain001

If you're officially answering your question, don't forget to Accept it to resolve the post.