Getting Data In

forwarder disk space issue

Susha
Engager

Hi All,

i am using below query to get forwarder disk utilization .. but its not working ..

index=os sourcetype=df host=de1secsplfwd002.dc-r.security.vodafone.com | strcat host '@' Filesystem Host_FileSystem | timechart avg(UsePct) by Host_FileSystem

basically our forwarder disk space is getting filled because of  some specific intelligence logs..

here we want to highlight respective team that because of their logs its getting sudden surge logs..

 

 

 

Labels (1)
0 Karma

somesoni2
Revered Legend

What issues are you seeing with result? 

0 Karma

nmohammed
Contributor

@Susha 

Is your forwarder sending disk space data and are you able to see any data in index=os ? breakdown the search query into individual parts and check 

index=os sourcetype=df host=de1secsplfwd002.dc-r.security.vodafone.com
index=os sourcetype=df host=de1secsplfwd002.dc-r.security.vodafone.com
| strcat host '@' Filesystem Host_FileSystem

 

 

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...