How to calculate the free disk capacity in MB?

[jip31]

hello

I use this code `in order to calculate the free disk space but I also need to know the capacity disk in MB. I am unable to find a counter for this. The value has to be displayed in the "x" variable. Could you help me, please?

| join type=outer host [search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" | eval Disk_Available_Space =round(Value, 0). " MBytes /x" ]

[FrankVl · Accepted solution]

Doesn't perfmon also have a % Free Space counter that you can use for this?

You can use the combination of those 2 counters to calculate the total space, for example (tune this to exactly what you need)

search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" OR counter="% Free Space"
| eval perc_free = if(counter="% Free Space",Value,null)
| eval mb_free = if(counter="Free Megabytes",Value,null)
| stats latest(mb_free) as mb_free latest(perc_free) as perc_free by instance,host
| eval total_space = mb_free / (perc_free) * 100

[jip31]

sorry but i dont succeed
in my field i Something like this :`mb_free "MB" / total_space "MB"

[FrankVl]

Can you please stop posting comments as answers. I can convert them to comments, but it is easier if you post them as a comment right away 🙂

Given that the data is in the fields mb_free and total_space. This should work to print it as you want:

| eval Disk_Available_Space = round(mb_free,0)."MB / ".round(total_space,0)."MB"

[jip31]

yes but i done this and it dont works

 eval Disk_Available_Space =round(Value, 0). " MBytes /.total_space" | table Disk_Available_Space

[FrankVl]

You need to take that part outside of the quotes.

[jip31]

Perfect thanks
last question i want mb free band total space in a same field seperated by \

[FrankVl]

You already pretty much had the code for that right? Just use .total_space to concatenate the total_space field to the string you already generated.

[jip31]

% Free Space dont give me directly the total space...

[FrankVl]

See my updated answer for how you can combine the 2 counters to calculate that.