Knowledge Management

How to calculate 'days-till-full' on storage dashboard?

wordy
Engager

Hi all,

I'm very new to Splunk, but have had some success using Dashboard Studio to display storage aggregate capacity.

I have a SizeUsed field which gives me the % full of the aggregate at various points in time.  I have set the queryParameters to earliest="-365d", and latest="now".

This is the search I am using to display the current % full in a SingleValue chart.  

index="lgt_netapp_prod"  source type="netapp:aggregate:csv"  Name="type_ctry_2000_h01_n01_fsas_02"
| timechart last(SizeUsed) span=3d

I also have an Area chart on the same dashboard showing the growth mapped out over 12 months.

I would like to calculate the number of days till the aggregate is full, using the daily growth rate of the aggregate over a 12 month period.

The logic for this, could be something like:

dailyGrowth = (last(SizeUsed) - first(SizeUsed))/365

capacityRemaining = 100 - last(SizeUsed)

daysTillFull = capacityRemaining / dailyGrowth

Unfortunately, I havent been able to figure out the syntax which would allow me to use the values in this way, and then display the result in a chart.

Is it possible someone could point me in the right direction here?  It would be a real feather in my cap if I could make this work for my employers.

Cheers.....

Labels (1)
Tags (1)
0 Karma
1 Solution

wordy
Engager

many thanks for the response.... the below worked for me 👍

**************************************

| stats earliest("SizeUsed") as firstSize, latest("SizeUsed") as lastSize

| eval capacityRemaining = 100-lastSize

| eval dailyGrowth = (lastSize-firstSize)/365

| eval daysTillFull = round(capacityRemaining/dailyGrowth,0)

| eval daysTillFull = if(daysTillFull < 0, "n/a", daysTillFull)

| table daysTillFull

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this approach.

| stats first("last(SizeUsed)") as firstSize, last("last(SizeUsed)") as lastSize
| eval capacityRemaining = 100 - lastSize
| eval daysTillFull = capacityRemaining / dailyGrowth

I have doubts about how well growth over 365 days will predict how soon maximum capacity will be reached.  Since growth typically is not linear, a spike in growth could cause the capacity to be reached sooner than predicted by the daily average.

---
If this reply helps you, Karma would be appreciated.

wordy
Engager

many thanks for the response.... the below worked for me 👍

**************************************

| stats earliest("SizeUsed") as firstSize, latest("SizeUsed") as lastSize

| eval capacityRemaining = 100-lastSize

| eval dailyGrowth = (lastSize-firstSize)/365

| eval daysTillFull = round(capacityRemaining/dailyGrowth,0)

| eval daysTillFull = if(daysTillFull < 0, "n/a", daysTillFull)

| table daysTillFull

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...