All Disk Drives in WIndows, One Chart, From Perfmon Data

[aferone]

I'd like to have one column chart showing the percentage of drive space taken on each of the drives in the screenshot. I wouldn't want "_total", but I would want the other 3.

How would I accomplish this?

Thanks!

[aferone]

This s what I mean...

[martin_mueller · Accepted solution]

Something like this?

source="Perform:FOO" instance!="_Total" | chart latest(Value) by instance

[martin_mueller]

I see. In that case, go back to my original answer (minus the typo):

source="Perfmon:FOO" instance!="_Total" | chart latest(Value) by instance

[aferone]

Oh, yeah. What I mean, however, is I want to be able to only see one instance of the SET of drives. 3 bars total in this case, for C:, D:, and E:.

[martin_mueller]

If you only want to see "C:" for example you can add instance="C:" to the search query.

[aferone]

Not sure I understand. Can you clarify?

[martin_mueller]

If you want only one instance in the result you could add a filter by instance to the initial search.

[aferone]

That does work, but now I get a chart for every instance of the log, let's say for the past 24 hours. How do I force it to only show one "set" of numbers?