Splunk Search

Disk Space Pie Charts from "df" Script in UNIX App

aferone
Builder

I'd like to set up pie charts for disk space from data coming from the "df" scripts from the UNIX app. In looking through the charting docs, I can see how to chart "count" data, but I am unclear how to chart a single value, coming from the "df" script. I tried the "transpose" command, but only "UsedG" is coming up on the chart.

The search below was developed with help from the Splunk Answers KB. Notice that we convert the "Used" field to gigabytes. It goes to a field called "UsedG", but this seems to screw up the table. It adds "UsedG" to the table, even though it is not defined in the search.

I basically want to use "Used" and "Available", which should give a complete pie chart. If there was a way to chart "Size" and "Used", that would probably be more accurate.

Thanks for the help!

host="myhost" sourcetype="df" 
| multikv fields Filesystem Type Size Used Avail UsePct MountedOn 
| search /home | table MountedOn Size Used Avail 
| eval UsedG = case(match(Used,"[M]"),round(tonumber(rtrim(Used,"M"))/1024,3),
       match(Used,"[T]"),round(tonumber(rtrim(Used,"T"))*1024,3),
       match(Used,"[G]"),round(tonumber(rtrim(Used,"G")),3))
Tags (2)
0 Karma
1 Solution

lguinn2
Legend

(Updated with convert command instead of eval, and explanation - also updated to address "every 5 minute" problem)
My first question is - so why do you calculate UsedG if you never want to use it?

This will get your pie chart

host="myhost" sourcetype="df" earliest=-10m
| multikv fields Used Avail MountedOn
| search /home 
| dedup MountedOn
| eval s = "Used,Available"
| makemv delim="," allowempty=t s
| mvexpand s
| eval Size = if(s=="Used",Used,Avail)
| convert memk(Size) as Size 
| chart sum(Size) as "Size in Gb" by s

Try this for a column chart:

host="myhost" sourcetype="df" 
| multikv fields Filesystem Type Size Used Avail UsePct MountedOn 
| dedup MountedOn
| eval s = "Used,TotalSize"
| makemv delim="," allowempty=t s
| mvexpand s
| eval Size = if(s=="Used",Used,Size)
| convert memk(Size) as Size 
| chart sum(Size) as "Size in Gb" by MountedOn, s

Explanation by line -

host="myhost" sourcetype="df"

| multikv fields Filesystem Type Size Used Avail UsePct MountedOn


The initial search and field extraction

| eval s = "Used,TotalSize"

| makemv delim="," allowempty=t s

| mvexpand s


Create a new variable s that contains 2 values. Tell Splunk to consider this a multi-valued field. Expand this event into two events, one for each value of s. Except for that, the events are the same. This turns s back into a single-valued field, but creates multiple events.

| eval Size = if(s=="Used",Used,Size)

Set the variable Size to the amount of disk used, when the field s refers to "used". Otherwise, the field is the total size, so use the original Size field

| convert memk(Size) as Size

Convert the Size into a true numeric field, representing KB

| chart sum(Size) as "Size in Gb" by MountedOn, s

Chart the size field, breaking it down by mount point, and within that by Used and TotalSize. If you chart this using a column chart, you can see the two bars side-by-side.

View solution in original post

aferone
Builder

Cool. Thanks, Chris!

0 Karma

christopher_hod
Path Finder

That's why I used the "|head 1" in my answer below. You could also use the latest() function.

FYI, if you want to use a pie chart, you're only going to want one value per filesystem.

You could also do one pie chart per filesystem, but that's more complex

0 Karma

aferone
Builder

I think I see what is happening. I had the time frame set to 1 hour, and the "df" command runs every 5 minutes. the query is adding together all of the "df" findings. How would I pull only the latest record, without having to rely on a timeframe?

0 Karma

aferone
Builder

This is what "df" is returning:

alt text

And this is what the query returns:

alt text

0 Karma

lguinn2
Legend

(Updated with convert command instead of eval, and explanation - also updated to address "every 5 minute" problem)
My first question is - so why do you calculate UsedG if you never want to use it?

This will get your pie chart

host="myhost" sourcetype="df" earliest=-10m
| multikv fields Used Avail MountedOn
| search /home 
| dedup MountedOn
| eval s = "Used,Available"
| makemv delim="," allowempty=t s
| mvexpand s
| eval Size = if(s=="Used",Used,Avail)
| convert memk(Size) as Size 
| chart sum(Size) as "Size in Gb" by s

Try this for a column chart:

host="myhost" sourcetype="df" 
| multikv fields Filesystem Type Size Used Avail UsePct MountedOn 
| dedup MountedOn
| eval s = "Used,TotalSize"
| makemv delim="," allowempty=t s
| mvexpand s
| eval Size = if(s=="Used",Used,Size)
| convert memk(Size) as Size 
| chart sum(Size) as "Size in Gb" by MountedOn, s

Explanation by line -

host="myhost" sourcetype="df"

| multikv fields Filesystem Type Size Used Avail UsePct MountedOn


The initial search and field extraction

| eval s = "Used,TotalSize"

| makemv delim="," allowempty=t s

| mvexpand s


Create a new variable s that contains 2 values. Tell Splunk to consider this a multi-valued field. Expand this event into two events, one for each value of s. Except for that, the events are the same. This turns s back into a single-valued field, but creates multiple events.

| eval Size = if(s=="Used",Used,Size)

Set the variable Size to the amount of disk used, when the field s refers to "used". Otherwise, the field is the total size, so use the original Size field

| convert memk(Size) as Size

Convert the Size into a true numeric field, representing KB

| chart sum(Size) as "Size in Gb" by MountedOn, s

Chart the size field, breaking it down by mount point, and within that by Used and TotalSize. If you chart this using a column chart, you can see the two bars side-by-side.

abhay24
Engager

Do we need to write a stanza seperately for inputs.conf in the host server ?
if so can you send me the stanza for getting df -h command data and ls -l command data.

0 Karma

aferone
Builder

It actually ended up above, since it is my own question.

0 Karma

aferone
Builder

I am going to post another "answer" below so that I can provide screenshots.

0 Karma

aferone
Builder

Thanks for replying again. Yes, all the values are correct.

0 Karma

lguinn2
Legend

Weird, sounds like maybe something is up with the multikv

You might try just running this to see if the extracted values are correct:

host="myhost" sourcetype="df"
| multikv fields Filesystem Type Size Used Avail UsePct MountedOn
| table fields Filesystem Type Size Used Avail UsePct MountedOn

0 Karma

aferone
Builder

So, now that I matching up the numbers from the chart and the actual log, they aren't matching up. I'm getting completely different results. The chart works, but it's the wrong values entirely. The search below christipherhodson brings back the right values, but just the Used values, and not total disk space.

0 Karma

aferone
Builder

Thank you!!

0 Karma

aferone
Builder

Can you just quickly breakdown how this works? I appreciate it!

0 Karma

aferone
Builder

I actually used "UsedG" for a different report.

I need to lookup some of the terms you used. I've never seen them before. I am still a noob in many ways!

This works great! Thanks!

0 Karma

christopher_hod
Path Finder

For starters, use |convert to normalize those values instead of that eval.

I would also drop that table command.

And you probably only want the most recent value, but you want all filesystems.

Finally, you need to actually chart the data.

So what we're left with is something like this:
host="myhost" sourcetype="df"
| head 1
| multikv fields Filesystem Type Size Used Avail UsePct MountedOn
| convert memk(Used)
| chart avg(Used) AS Used by Filesystem

lguinn2
Legend

Nice use of the memk function!

0 Karma

aferone
Builder

Thanks for your answer! I learned some new terms from your input. Thanks again!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...