Hello,
I'm using SAI to get filesystem usage, unfortunately the mountpoint is not populated, or better it is partial.
The following query (KPI in ITSI)
| mstats min(df.free) as "df_free" max(df.used) as "df_used" WHERE `sai_metrics_indexes` by host,mount span=30s | eval host_dev = host . ":" . mount
doesn't work because the dimension "mount" is missing. Changing "mount" with "device" I get result without mountpoint.
Trying to change the collectd.conf (red part)
<Plugin df>
FSType "ext2"
FSType "ext3"
FSType "ext4"
FSType "XFS"
FSType "rootfs"
FSType "overlay"
FSType "hfs"
FSType "apfs"
FSType "zfs"
FSType "ufs"
MountPoint "/^/.+/"
ReportByDevice false
ValuesAbsolute false
ValuesPercentage true
IgnoreSelected false
</Plugin>
I get data only from one mountpoint (/boot) the other ones are still missing. I don't understand because the mount dimension is missing and only partial mountpoints are taken.
Is it my fault ?
I use the latest version of SAI, ITSI 4.4.3 and Splunk 8.0.3
Thanks
