"df" ave(used) not giving consistent results

[hartfoml]

I have this search to find disk space use over time;

`index="os" sourcetype="df" host=All_My_Servers | multikv fields FileSystem, Size Used Avail UsePct MountedOn | search MountedOn=*index* | timechart span=1d avg(Used) by host`

this is the event data;

`/dev/mapper/node3_vg-index3_lv   xfs     5.5T        3.6T        2.0T         65%    /mnt/index3`

So the avg(used) shows as 3.6
On some systems I have this event data;

`/dev/mapper/index2_vg-index2_lv   xfs     1.0T         50G        974G          5%    /mnt/index2`

in this event the avg(Used) shows as 50000000
I tried to separate the host that have Terabytes and Gigabytes in different searches but when I do this | eval GB_Used=(Used/1024/1024) I get no results

Anyone know why this is happening or how I could get both system with T and G drive use on the same chart. or maybe there is a better way all together.

[hartfoml]

Linu you should have put this as an answer so I could have selected it as the answer.

Thanks I will use the % filled

[gathiu · Accepted solution]

Hi,

Well, I would focus directly on the source of data - why there is TB or GB? Why not only one "size"?
I would recommend to switch from 'df -h' to 'df -k' to get one "size", otherwise you got in such topics as "how to convert one value to be comparable with other one" ...

Other topics the "percentage" - better for comparing or setting the thresholds/limits ...

[linu1988]

I would say to go with the Percentage, It's more appropriate and user friendly to understand. There are workarounds with replacing and converting them into GB and TB bytes.