Please tell me know how can I get UsePct data?
I must get the UsePct data which the MountedOn="/tmp" . Already type like below:
index=* sourcetype=df MountedOn="/tmp"
|table host,UsePct
But that hav't any result of UsePct.
Please help me.
I try type like below, but still not good..........
index=* source=df "/tmp"
| multikv fields Filesystem Avail UsePct
| table host,UsePct
Please.......help me....
you can use either fields Mount
or MountedOn
and then use the PercentUsedSpace
or PercentFreeSpace
fields
verify you have them and so something like this:
index=os sourcetype=df MountedOn="\tmp" | stats latest(PercentFreeSpace) as last_free Avg(PercentFreeSpace) as avg_free ... by host
you can use either fields Mount
or MountedOn
and then use the PercentUsedSpace
or PercentFreeSpace
fields
verify you have them and so something like this:
index=os sourcetype=df MountedOn="\tmp" | stats latest(PercentFreeSpace) as last_free Avg(PercentFreeSpace) as avg_free ... by host
Thank you for your answer.
But when I use Mounted or Mount in the Search
the result of Events and Statistics is "No results found. Try expanding the time range. "
However, only type in
index=* sourcetype=df "tmp"
I can get some data of the result
Finally...I type like below
index=* sourcetype=df "/tmp"
| stats latest(PercentUsedSpace) as last_free Avg(PercentUsedSpace) as avg_free by host
| table host,last_free,avg_free
But the last_free and avg_free in table of Statistics still empty.........
do you see the relevant fields? PercentUsedSpace PercentFreeSpace
Oh, that's why......
My main language isn't English, I got you wrong.
Let me check the relevant fields.......
Thank you very much
are you using the Nix TA?
yes....but the linux...
Could you help me?
It's driving me nuts...........