Splunk Search

Calculate a % based on two Windows Perfmon Counters


I am trying to calculate the percentage usage of disk from an application based on it's perfmon counters. Unfortunately it doesn't give me this value as a counter. I have "Data File Size" and "Data File Space Used". But as a newbie, how to do take the Value fields into something I can use?


Tags (1)
0 Karma


I can't tell from the counter names what the difference is between them, so my formula may be off, but I got something like the following to work:

index=perfmon counter="Data File Size" | stats avg(Value) as Avg1 by host | join host [search index=perfmon counter="Data File Space Used" | stats avg(Value) as Avg2 by host] | eval Ratio=Avg1/Avg2 | fields host,Ratio

I feel like there should be a solution that doesn't run a join, but if your data isn't too extensive this might work. Let me know if that helps.


Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...