Monitoring Splunk

How to calculate the free disk capacity in MB?

Contributor

hello

I use this code `in order to calculate the free disk space but I also need to know the capacity disk in MB. I am unable to find a counter for this. The value has to be displayed in the "x" variable. Could you help me, please?

| join type=outer host [search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" | eval Disk_Available_Space =round(Value, 0). " MBytes /x" ]
0 Karma
1 Solution

Ultra Champion

Doesn't perfmon also have a % Free Space counter that you can use for this?

You can use the combination of those 2 counters to calculate the total space, for example (tune this to exactly what you need)

search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" OR counter="% Free Space"
| eval perc_free = if(counter="% Free Space",Value,null)
| eval mb_free = if(counter="Free Megabytes",Value,null)
| stats latest(mb_free) as mb_free latest(perc_free) as perc_free by instance,host
| eval total_space = mb_free / (perc_free) * 100

View solution in original post

0 Karma

Ultra Champion

Doesn't perfmon also have a % Free Space counter that you can use for this?

You can use the combination of those 2 counters to calculate the total space, for example (tune this to exactly what you need)

search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" OR counter="% Free Space"
| eval perc_free = if(counter="% Free Space",Value,null)
| eval mb_free = if(counter="Free Megabytes",Value,null)
| stats latest(mb_free) as mb_free latest(perc_free) as perc_free by instance,host
| eval total_space = mb_free / (perc_free) * 100

View solution in original post

0 Karma

Contributor

sorry but i dont succeed
in my field i Something like this :`mbfree "MB" / totalspace "MB"

0 Karma

Ultra Champion

Can you please stop posting comments as answers. I can convert them to comments, but it is easier if you post them as a comment right away 🙂

Given that the data is in the fields mbfree and totalspace. This should work to print it as you want:

| eval Disk_Available_Space = round(mb_free,0)."MB / ".round(total_space,0)."MB"
0 Karma

Contributor

yes but i done this and it dont works

 eval Disk_Available_Space =round(Value, 0). " MBytes /.total_space" | table Disk_Available_Space
0 Karma

Ultra Champion

You need to take that part outside of the quotes.

0 Karma

Contributor

Perfect thanks
last question i want mb free band total space in a same field seperated by \

0 Karma

Ultra Champion

You already pretty much had the code for that right? Just use .total_space to concatenate the total_space field to the string you already generated.

0 Karma

Contributor

% Free Space dont give me directly the total space...

0 Karma

Ultra Champion

See my updated answer for how you can combine the 2 counters to calculate that.

0 Karma