Splunk Search
Highlighted

Disk Space Pie Charts from "df" Script in UNIX App

Builder

I'd like to set up pie charts for disk space from data coming from the "df" scripts from the UNIX app. In looking through the charting docs, I can see how to chart "count" data, but I am unclear how to chart a single value, coming from the "df" script. I tried the "transpose" command, but only "UsedG" is coming up on the chart.

The search below was developed with help from the Splunk Answers KB. Notice that we convert the "Used" field to gigabytes. It goes to a field called "UsedG", but this seems to screw up the table. It adds "UsedG" to the table, even though it is not defined in the search.

I basically want to use "Used" and "Available", which should give a complete pie chart. If there was a way to chart "Size" and "Used", that would probably be more accurate.

Thanks for the help!

host="myhost" sourcetype="df" 
| multikv fields Filesystem Type Size Used Avail UsePct MountedOn 
| search /home | table MountedOn Size Used Avail 
| eval UsedG = case(match(Used,"[M]"),round(tonumber(rtrim(Used,"M"))/1024,3),
       match(Used,"[T]"),round(tonumber(rtrim(Used,"T"))*1024,3),
       match(Used,"[G]"),round(tonumber(rtrim(Used,"G")),3))
Tags (2)
0 Karma
Highlighted

Re: Disk Space Pie Charts from "df" Script in UNIX App

Path Finder

For starters, use |convert to normalize those values instead of that eval.

I would also drop that table command.

And you probably only want the most recent value, but you want all filesystems.

Finally, you need to actually chart the data.

So what we're left with is something like this:
host="myhost" sourcetype="df"
| head 1
| multikv fields Filesystem Type Size Used Avail UsePct MountedOn
| convert memk(Used)
| chart avg(Used) AS Used by Filesystem

Highlighted

Re: Disk Space Pie Charts from "df" Script in UNIX App

Builder

Thanks for your answer! I learned some new terms from your input. Thanks again!

0 Karma
Highlighted

Re: Disk Space Pie Charts from "df" Script in UNIX App

Legend

Nice use of the memk function!

0 Karma
Highlighted

Re: Disk Space Pie Charts from "df" Script in UNIX App

Legend

(Updated with convert command instead of eval, and explanation - also updated to address "every 5 minute" problem)
My first question is - so why do you calculate UsedG if you never want to use it?

This will get your pie chart

host="myhost" sourcetype="df" earliest=-10m
| multikv fields Used Avail MountedOn
| search /home 
| dedup MountedOn
| eval s = "Used,Available"
| makemv delim="," allowempty=t s
| mvexpand s
| eval Size = if(s=="Used",Used,Avail)
| convert memk(Size) as Size 
| chart sum(Size) as "Size in Gb" by s

Try this for a column chart:

host="myhost" sourcetype="df" 
| multikv fields Filesystem Type Size Used Avail UsePct MountedOn 
| dedup MountedOn
| eval s = "Used,TotalSize"
| makemv delim="," allowempty=t s
| mvexpand s
| eval Size = if(s=="Used",Used,Size)
| convert memk(Size) as Size 
| chart sum(Size) as "Size in Gb" by MountedOn, s

Explanation by line -

host="myhost" sourcetype="df"

| multikv fields Filesystem Type Size Used Avail UsePct MountedOn


The initial search and field extraction

| eval s = "Used,TotalSize"

| makemv delim="," allowempty=t s

| mvexpand s


Create a new variable s that contains 2 values. Tell Splunk to consider this a multi-valued field. Expand this event into two events, one for each value of s. Except for that, the events are the same. This turns s back into a single-valued field, but creates multiple events.

| eval Size = if(s=="Used",Used,Size)

Set the variable Size to the amount of disk used, when the field s refers to "used". Otherwise, the field is the total size, so use the original Size field

| convert memk(Size) as Size

Convert the Size into a true numeric field, representing KB

| chart sum(Size) as "Size in Gb" by MountedOn, s

Chart the size field, breaking it down by mount point, and within that by Used and TotalSize. If you chart this using a column chart, you can see the two bars side-by-side.

View solution in original post

Highlighted

Re: Disk Space Pie Charts from "df" Script in UNIX App

Builder

I actually used "UsedG" for a different report.

I need to lookup some of the terms you used. I've never seen them before. I am still a noob in many ways!

This works great! Thanks!

0 Karma
Highlighted

Re: Disk Space Pie Charts from "df" Script in UNIX App

Builder

Can you just quickly breakdown how this works? I appreciate it!

0 Karma
Highlighted

Re: Disk Space Pie Charts from "df" Script in UNIX App

Builder

Thank you!!

0 Karma
Highlighted

Re: Disk Space Pie Charts from "df" Script in UNIX App

Builder

So, now that I matching up the numbers from the chart and the actual log, they aren't matching up. I'm getting completely different results. The chart works, but it's the wrong values entirely. The search below christipherhodson brings back the right values, but just the Used values, and not total disk space.

0 Karma
Highlighted

Re: Disk Space Pie Charts from "df" Script in UNIX App

Legend

Weird, sounds like maybe something is up with the multikv

You might try just running this to see if the extracted values are correct:

host="myhost" sourcetype="df"
| multikv fields Filesystem Type Size Used Avail UsePct MountedOn
| table fields Filesystem Type Size Used Avail UsePct MountedOn

0 Karma