Splunk Search

All Disk Drives in WIndows, One Chart, From Perfmon Data

Builder

I'd like to have one column chart showing the percentage of drive space taken on each of the drives in the screenshot. I wouldn't want "_total", but I would want the other 3.

How would I accomplish this?

Thanks!

alt text

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Something like this?

source="Perform:FOO" instance!="_Total" | chart latest(Value) by instance

View solution in original post

0 Karma

Builder

This s what I mean...

alt text

0 Karma

SplunkTrust
SplunkTrust

Something like this?

source="Perform:FOO" instance!="_Total" | chart latest(Value) by instance

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

I see. In that case, go back to my original answer (minus the typo):

source="Perfmon:FOO" instance!="_Total" | chart latest(Value) by instance
0 Karma

Builder

Oh, yeah. What I mean, however, is I want to be able to only see one instance of the SET of drives. 3 bars total in this case, for C:, D:, and E:.

0 Karma

SplunkTrust
SplunkTrust

If you only want to see "C:" for example you can add instance="C:" to the search query.

0 Karma

Builder

Not sure I understand. Can you clarify?

0 Karma

SplunkTrust
SplunkTrust

If you want only one instance in the result you could add a filter by instance to the initial search.

0 Karma

Builder

That does work, but now I get a chart for every instance of the log, let's say for the past 24 hours. How do I force it to only show one "set" of numbers?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!