Hello everyone
Is there a way to determine what occupies disk storage?
The following SPL yields a line graph that shows disk utilization per host and each of its drives.
index=winperf_prod sourcetype=*Perfmon* storage_free_percent="*"
| eval storage_used_percent=round(100-storage_free_percent,2)
| eval host_dev=printf("%s:%s\\",host,instance)
| timechart max(storage_used_percent) by host_dev
Now I want to determine what the drop in one of the drives cause on February 12. Ideally I get a list of all processes/files/etc. that occupy disk storage.
Help is appreciated 😃
I think disk usage info isn't enough to answer the question. You need file-level data (creates, deletes, etc.) from other inputs. Perhaps you could just run du on the system with the drive in question?
Thanks for the hint! Tracking the files (by means of du) would then let me understand what makes up disk usage.
I think disk usage info isn't enough to answer the question. You need file-level data (creates, deletes, etc.) from other inputs. Perhaps you could just run du on the system with the drive in question?