Disk Usage: How to show memory consuming files?

[Gabriel]

Hello everyone

Is there a way to determine what occupies disk storage?

The following SPL yields a line graph that shows disk utilization per host and each of its drives.

index=winperf_prod sourcetype=*Perfmon* storage_free_percent="*"
| eval storage_used_percent=round(100-storage_free_percent,2)
| eval host_dev=printf("%s:%s\\",host,instance)
| timechart max(storage_used_percent) by host_dev

image.png

 Now I want to determine what the drop in one of the drives cause on February 12. Ideally I get a list of all processes/files/etc. that occupy disk storage.

Help is appreciated 😃

[Gabriel]

Thanks for the hint! Tracking the files (by means of du) would then let me understand what makes up disk usage.

[richgalloway · Accepted solution]

I think disk usage info isn't enough to answer the question.  You need file-level data (creates, deletes, etc.) from other inputs.  Perhaps you could just run du on the system with the drive in question?