Splunk Search

Display disk space usage in chart format

manderson7
Contributor

I am able to display disk space via the Pie Chart visualization, but I'd like to display w/ a chart, like what's in this vmware dashboard:
http://blogs.splunk.com/wp-content/uploads/2012/06/splunkx_dash_02.jpg

host=host sourcetype="df" "/dev/sda2" | dedup host | chart

I think that's how I want to start, but don't know how to finish. Thanks much for any help.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Based on your last comment to my first answer, do this:

 host=host sourcetype="df" "/dev/sda2" | dedup host | chart avg(PercentUsedSpace) by host

When you use table it tells Splunk not to attempt a visualization whereas chart implies a visualization and tells Splunk to attempt to do so.

View solution in original post

woodcock
Esteemed Legend

Based on your last comment to my first answer, do this:

 host=host sourcetype="df" "/dev/sda2" | dedup host | chart avg(PercentUsedSpace) by host

When you use table it tells Splunk not to attempt a visualization whereas chart implies a visualization and tells Splunk to attempt to do so.

woodcock
Esteemed Legend

Like this?

host=host sourcetype="df" "/dev/sda2" | dedup host | table *
0 Karma

manderson7
Contributor

Just about. That shows all the values for a df in the chart, which granted, is what I asked for. I guess what I'd really like to see is, on a scale of 100%, the used percentage of, say, /dev/sda2. I'm hoping to add multiple hosts to this query, and display each w/ a different color on the graph.
Thank you very much for your reply and assistance.

edit: I tried host=host sourcetype="df" "/dev/sda2" | dedup host | table PercentUsedSpace, which shows the correct value in statistics, but nothing in Visualization.

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...