Hi, I am very new to Splunk reporting and I am trying to change a timechart I have to show in GB since we are using a 4TB disk share. Below is my search query. It comes up OK, but just trying to make it more friendly.
index=perfmon host=ServerName eventtype=perfmon_windows NetShare14| timechart span=24h avg(Free_Megabytes) as MB_Free
Thanks
Kesrich
Use eval to convert the values.
index=perfmon host=ServerName eventtype=perfmon_windows NetShare14
| eval GB_Free = Free_Megabytes/1024
| timechart span=24h avg(GB_Free) as GB_Free
Thanks everyone for the suggestions. I wasn't familiar with "eval". That helped.
Actually reverse perform timechart to get daily data hoping even if you are querying 1 year of data it will be 365 rows. Then apply eval
index=perfmon host=ServerName eventtype=perfmon_windows NetShare14
| timechart span=24h avg(Free_Megabytes) as GB_Free
| eval GB_Free=round(GB_Free,2)
Read more about eval command in Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval
You could try to use the following before your timechart: | eval GB_Free=(Free_Megabytes/1024).
Then change your timechart to the following:
| timechart span=24h avg(GB_Free) as GB_Free
Use eval to convert the values.
index=perfmon host=ServerName eventtype=perfmon_windows NetShare14
| eval GB_Free = Free_Megabytes/1024
| timechart span=24h avg(GB_Free) as GB_Free