hello
when i execute the search below I have no results
index="tutu" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space" OR index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB
| eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval Value = round(Value, 1). " %"
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " GB"
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host
But no matter index I delete I have results
example :
index="tutu" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space"
| eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval Value = round(Value, 1). " %"
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " GB"
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host
index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB
| eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval Value = round(Value, 1). " %"
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " GB"
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host
what is the issue please??
Hi @jip31,
Please use the following syntax for the first part of your query and make sure you have results :
(index="tutu" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space" ) OR (index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB)
Once this is working add the rest :
... | eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval Value = round(Value, 1). " %"
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " GB"
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host
Let me know if it helps.
Cheers,
David
Hi @jip31,
Please use the following syntax for the first part of your query and make sure you have results :
(index="tutu" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space" ) OR (index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB)
Once this is working add the rest :
... | eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval Value = round(Value, 1). " %"
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " GB"
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host
Let me know if it helps.
Cheers,
David
@jip31
Have you tried this?
(index="tutu" sourcetype="perfmon:logicaldisk" instance="C:" counter="% Free Space") OR (index="titi" sourcetype=WinHostMon Type=disk Name="C:" TotalSpaceKB)
| eval time = strftime(_time, "%m/%d/%Y %H:%M")
| eval Value = round(Value, 1). " %"
| eval TotalSpace = TotalSpaceKB/1024
| eval TotalSpace = round(TotalSpace/1024,1). " GB"
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host