Getting Data In

forwarder disk space issue

Susha
Engager

Hi All,

i am using below query to get forwarder disk utilization .. but its not working ..

index=os sourcetype=df host=de1secsplfwd002.dc-r.security.vodafone.com | strcat host '@' Filesystem Host_FileSystem | timechart avg(UsePct) by Host_FileSystem

basically our forwarder disk space is getting filled because of  some specific intelligence logs..

here we want to highlight respective team that because of their logs its getting sudden surge logs..

 

 

 

Labels (1)
0 Karma

somesoni2
Revered Legend

What issues are you seeing with result? 

0 Karma

nmohammed
Builder

@Susha 

Is your forwarder sending disk space data and are you able to see any data in index=os ? breakdown the search query into individual parts and check 

index=os sourcetype=df host=de1secsplfwd002.dc-r.security.vodafone.com
index=os sourcetype=df host=de1secsplfwd002.dc-r.security.vodafone.com
| strcat host '@' Filesystem Host_FileSystem

 

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...