Converting MB to GB

[kesrich]

Hi, I am very new to Splunk reporting and I am trying to change a timechart I have to show in GB since we are using a 4TB disk share. Below is my search query. It comes up OK, but just trying to make it more friendly.

index=perfmon host=ServerName eventtype=perfmon_windows NetShare14| timechart span=24h avg(Free_Megabytes) as MB_Free

Thanks

Kesrich

[kesrich]

Thanks everyone for the suggestions. I wasn't familiar with "eval". That helped.

[niketn]

Actually reverse perform timechart to get daily data hoping even if you are querying 1 year of data it will be 365 rows. Then apply eval

index=perfmon host=ServerName eventtype=perfmon_windows NetShare14
| timechart span=24h avg(Free_Megabytes) as GB_Free
| eval GB_Free=round(GB_Free,2)

Read more about eval command in Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval 

[MattibergB]

You could try to use the following before your timechart: | eval GB_Free=(Free_Megabytes/1024).

Then change your timechart to the following:

| timechart span=24h avg(GB_Free) as GB_Free

[richgalloway · Accepted solution]

Use eval to convert the values.

index=perfmon host=ServerName eventtype=perfmon_windows NetShare14
| eval GB_Free = Free_Megabytes/1024
| timechart span=24h avg(GB_Free) as GB_Free