I am trying to make a chart of disk space used over time but the query I have built (below) simply returns a result of '1' indicating that a value is present, how can I extract the value of 'Value' to use in a chart?
Here is an example of the data:
collection="Free Disk Space"
host=ROMERO Options| sourcetype=Perfmon:Free Disk Space
Using this query:
host="romero" source="Perfmon:Free Disk Space" | timechart values(Value) as FreeSpace
I get a result that looks like this:
6/8/11 12:00:00.000 AM
6/9/11 12:00:00.000 AM
When I chart this result, each Value, is shown on the chart with a value of '1' so each time-frame simply shows the number of values in that time period, which is the same every time period obviously, rather than using the actual values to draw the chart to show how much space is being used.
Is it possible extract these values for use in a chart?
Sure. First, some explanation for how
timechart needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:
host="romero" source="Perfmon:Free Disk Space" | timechart span=1m avg(Value) as FreeSpace
Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats
There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.
host="romero" source="Perfmon:Free Disk Space" | table _time Values
Thanks Ayn 🙂
host="romero" source="Perfmon:Free Disk Space" | timechart span=30m avg(Value) as FreeSpace
Worked a treat 😄
nb. I changed the timespan, as the disk space is only read every 30 minutes.