Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How to show Disk Space in Pie Chart
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have my own PC for which I have to show the used disk space value in Pie chart on splunk.. I have something query like this where I have 2 counters. One is "Free Megabytes" and another is "% Free Space" but from where it takes the used disk space as from perfmon logs i am not able to locate used disk space value.
index=sc-perfmon sourcetype="Perfmon*" counter="Free Megabytes" OR "% Free Space" | stats count by counter
Thanks
Ankit
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you use this search index=sc-perfmon sourcetype="Perfmon*" source=Perfmon:FreeDiskSpace host=BWIN7136 Name="D:" | timechart eval(sum(TotalSpaceKB) / 1048576) as Total_Space, eval(sum(FreeSpaceKB) / 1048576) as Free_Space | eval consumed_space = Total_Space - Free_Space
you use the fields "TotalSpaceKB" and "" FreeSpaceKB "in your Requette but I do not think these fields are in your data. exchange them with the corresponding fields in your data as they are part of the data of Mr lukas.loder
try also like this:
index=sc-perfmon sourcetype="Perfmon*"|timechart sum(eval(counter="Free Megabytes" OR counter="% Free Space")) as free_megabit sum(eval(counter!="Free Megabytes" OR counter!="% Free Space")) as used_space
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks for the guidance but with the below given query my splunk is showing only (free space) parameter. Total space and used space it is showing blank..
index=sc-perfmon sourcetype="Perfmon*"|eventstats count as total_space|stats count(eval(counter="Free Megabytes")) as free_megabit count(eval(counter="% Free Space" )) as "free"|eval free_space=free_megabit +free| eval used_space=total_space - free_space|table total_space free_space used_space
Regards
Ankit
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
update it like this and let me know again.
index=sc-perfmon sourcetype="Perfmon*"|stats count as total_space count(eval(counter="Free Megabytes")) as free_megabit count(eval(counter="% Free Space" )) as "free"|eval free_space=free_megabit +free| eval used_space=total_space - free_space|table total_space free_space used_space
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Note. Please you have to know how to comment an answer. You was suppose to write your requirement above as a comment for my answer. Thanks
Now lets turn back.
I think you must evaluate the used space values or you can simply do somethink like this, if you just need used space values
index=sc-perfmon sourcetype="Perfmon*" NOT (counter="Free Megabytes" OR counter="% Free Space" )| stats count as "used spaces"
with the evaluation, here you go:
index=sc-perfmon sourcetype="Perfmon*"|eventstats count as total_space|stats count(eval(counter="Free Megabytes")) as free_megabit count(eval(counter="% Free Space" )) as "free"|eval free_space=free_megabit +free| eval used_space=total_space - free_space|table total_space free_space used_space
Thanks
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
