taking the information about disks from the Splunk_TA_nix you have the following informations:
that you can use to do all the comparisons you want.
e.g. the time distribution od UsePct in time so you could trace the UsePct data, something like this:
index=os sourcetype=df | multikv | timechart span=1h max(UsePct) AS perc By host
fields: size = 15T, mountedon = /stg UsePct =92%, Used=14T, Avail = 1.4T
the requirement is to have
for each mount, Size and Used space side-by-side column chart or any other chart at any given moment and trend, just for visualization.
I am getting it in table part using
| stats latest(Size) as "TotalStorage" by mount,Used | rename Used as UsedStorage
To have a time distribution, try something like this:
index=os sourcetype=df host=your_host | multikv | bin span=1h _time | stats latest(Size) AS "TotalStorage" latest(Used) AS Used latest(UsePct) AS UsePct by Filesystem _time