Getting Data In

WMI:FreeDiskSpace returns information about the CD-ROM drive on the server

usup_rajbahak
Path Finder

I am using the following wmi query to gather free disk space info on a Windows 2008 R2 server. The problem I have is that the query seems to be sending information not only of the local disk on the server but also of the CD-ROM drive installed on the server.

[WMI:FreeDiskSpace]
interval = 600
wql = select Name, FreeSpace from Win32_LogicalDisk
index = default
disabled = 0

Here's the data the universal forwarder on the server is sending to Splunk, which I think is the data for the CD-ROM drive. Notice the NULL value for the FreeSpace parameter?

20120905135639.531544
FreeSpace=NULL
Name=D:
wmi_type=FreeDiskSpace
host=paul Options| sourcetype=WMI:FreeDiskSpace Options| source=WMI:FreeDiskSpace Options

How do I get the universal forwarder send the free space information data only for the actual disk drives and not the cd-rom drive?

Thanks a lot in advance.

Tags (1)
0 Karma
1 Solution

Drainy
Champion

You could always add a where to the end of your query, something like;

Where Name = 'C:' OR where Name = 'E:' etc, you may need to use C:\ depending on your system

View solution in original post

0 Karma

Drainy
Champion

You could always add a where to the end of your query, something like;

Where Name = 'C:' OR where Name = 'E:' etc, you may need to use C:\ depending on your system

0 Karma

Drainy
Champion

Sorry, it wasn't very clear, the whole statement from where to 'E:' is to allow for two Names. The OR is part of the query 🙂

0 Karma

usup_rajbahak
Path Finder

Thanks for your prompt reply Drainy. It's working for me now :-).

But then, what if I have two logical drives?

will "Where Name = 'C:' and 'the next logical drive:'" work?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...