Help with creating a Pie Chart for DiskSpace Usage

[apvoelk]

Hello,

Ive tried to create a Pie Chart depicting the different Disks and it's free/used space. via trellis I want to show it by instance (the disk in question for example c:/) 

now I've used the following spl to find the needed values for free and used(full) diskspace but it doesn't give me a correct pie chart. I'm fairly sure it is because I need to turn the headers or the fields in a way to be usable by the pie chart but I can't seem to find a good way how. 

can anyone help me ? 

Thanks a lot!

André

[JohnEGones]

...does a visualization for pie chart render when you click on the visualizations tab?

[apvoelk]

Yes i does, but nothing like I want.  without trelliswith trellis by instance

What I actually want is something like this, only for each instance: 

When I manage to make it look like this at least I still can't use trellis to show me all different instances (disks), only the one in the first row. : 

| mstats 
max("% Free Space") as "MB", max("Free Megabytes") as "FreeMB"
WHERE 
index=m_windows_perfmon
AND
host=NTSAP10 span=1d by instance
| search instance!=hard*
| search instance!=_Total
| eval FreeDiskspace=round(FreeMB/1024,2)
| eval TotalDiskspace=round((FreeDiskspace/MB)*100,2)
| eval FullDiskspace=round(TotalDiskspace-FreeDiskspace,2)
| dedup instance
| table FreeDiskspace TotalDiskspace
| transpose 0 column_name=instance

the table then looks like this currently: 

the rows must be the instances, so c, d, e etc. and I can't split by instance in trellis for whatever reason either.

[ITWhisperer]

What search have you used for these visualisations?

[apvoelk]

Hi,

so like in the screenshot - but here it is again: 

|mstats max ("% Free Space") as "MB", max("Free Megabytes") as "FreeMB"
WHERE
index=m_windows_perfmon
AND
host=NTSAP10 span=1d by instance
|search instance!=hard*
|search instance!=_Total
|eval FreeDiskspace=round(FreeMB/1024,2)
|eval TotalDiskspace=round((FreeDiskspace/MB)*100,2)
|eval FullDiskspace=round(TotalDiskspace-FreeDiskspace,2)
|stats max("FreeDiskspace") as "Free Diskspace (GB)", max("FullDiskspace") as "Full Diskspace (GB)" by instance

so it's metrics I'm trying to use for it . The free space and free megabytes metrics from my windows perfmon index. I exclude instances that have hard or total in it and then eval three versions of the diskspace. this way I have the free diskspace in gb, the total diskspace and the full, so used, diskspace. 

the free and the full(used) diskspace are the ones I'm having in the table, again as seen above, but when I try the pie chart it shows me not what I am looking for. 

I'd like to have pie charts for each instance which lets the pie chart show the free and used space together. right now it only shows me either of two things:

- only the free or the full space per instance

- all free spaces from all instances in one pie chart 

[ITWhisperer]

It looks like, for trellis pie charts, you have to calculate the values as percentages i.e. each row should add up to 100. Since you already have the free percentage you can simply calculate the used percentage.

[apvoelk]

I'll try this next , okay

[ITWhisperer]

What settings have you used for your pie chart visualisation?

[apvoelk]

Trellis by instance . Instance being the specific Disk .. so c:/ etc. 

but what you can see above is that when I use trellis (or don't) it only shows me either the partial free/full spaces but not in regards to the full disk. 

I would like to see a pie chart in which each instance is shown with its used diskspace and the remaining free diskspace. but for whatever reason it doesn't.

[JohnEGones]

You may find something helpful here: 

Solved: Pie chart max value - Splunk Community

[apvoelk]

sadly no