Hi
I use the query below
index="perfmon-fr" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space"
| dedup host
| eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval Value = round(Value, 1). " %"
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " MB"
| rename Value as Free_Space
| eval Free_Space= if(Free_Space>15, "GOOD", "BAD")
| table Free_Space
But I have always a "BAD" result even if Free_Space < 15
What is the problem please??
@jip31,
| eval Value = round(Value, 1). " %"
will result in Value% , for e.g. 80% and then you are doing a numerical comparison against that which is always false.
Try
| eval Value = round(Value, 1)
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " MB"
| rename Value as Free_Space
| eval Free_Space= if(Free_Space>15, "GOOD", "BAD")
| table Free_Space
or even simpler
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " MB"
| eval Free_Space = if(Value>15, "GOOD", "BAD")
@jip31,
| eval Value = round(Value, 1). " %"
will result in Value% , for e.g. 80% and then you are doing a numerical comparison against that which is always false.
Try
| eval Value = round(Value, 1)
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " MB"
| rename Value as Free_Space
| eval Free_Space= if(Free_Space>15, "GOOD", "BAD")
| table Free_Space
or even simpler
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " MB"
| eval Free_Space = if(Value>15, "GOOD", "BAD")
perfect thanks renjith