All Apps and Add-ons

Splunk App for NetApp Data ONTAP: Why does my sourcetype=ontap:volume search return some volumes with a null value for size-used and size-total?


Hi all,

sourcetype=ontap:volume (source="volume-list-info-iter-start" OR source="volume-get-iter") | stats first(&#42) as &#42 by host, name | table host, name, size-available, size-used, size-total

When I run this search, I always get the correct value for "size-available", but some (not all) volumes have a null value for "size-used" and "size-total".

It does not seem to be related to the DOT version on the NetApp as I have another NetApp pair running the same version which does not exhibit this behaviour.



sz_free and storage_used_percent fields are always present, so sz_used and sz_total can be calculated:

sourcetype=ontap:volume (source="volume-list-info-iter-start" OR source="volume-get-iter") | `CoalesceVolumeFields` | eval na_gb_used=`BytesToGigaBytes(sz_used)` | eval gb_free=`BytesToGigaBytes(sz_free)` | eval na_gb_total=`BytesToGigaBytes(sz_total)` | eval calc_total=100 * (sz_free / (100 - storage_used_percent)) | eval calc_gb_total=`BytesToGigaBytes(calc_total)` | eval calc_gb_used=calc_gb_total - gb_free | eval gb_total=if(na_gb_total == "Null", calc_gb_total, na_gb_total) | eval gb_used=if(na_gb_used == "Null", calc_gb_used, na_gb_used) | stats first(*) as * by host, name | table host, name, gb_free, gb_used, gb_total | stats sum(*) as * by host | eval percent_used=round(100*gb_used/gb_total,1)
0 Karma


Hi @iain001

If you're officially answering your question, don't forget to Accept it to resolve the post.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...