Splunk Search

Display disk space usage in chart format

manderson7
Contributor

I am able to display disk space via the Pie Chart visualization, but I'd like to display w/ a chart, like what's in this vmware dashboard:
http://blogs.splunk.com/wp-content/uploads/2012/06/splunkx_dash_02.jpg

host=host sourcetype="df" "/dev/sda2" | dedup host | chart

I think that's how I want to start, but don't know how to finish. Thanks much for any help.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Based on your last comment to my first answer, do this:

 host=host sourcetype="df" "/dev/sda2" | dedup host | chart avg(PercentUsedSpace) by host

When you use table it tells Splunk not to attempt a visualization whereas chart implies a visualization and tells Splunk to attempt to do so.

View solution in original post

woodcock
Esteemed Legend

Based on your last comment to my first answer, do this:

 host=host sourcetype="df" "/dev/sda2" | dedup host | chart avg(PercentUsedSpace) by host

When you use table it tells Splunk not to attempt a visualization whereas chart implies a visualization and tells Splunk to attempt to do so.

woodcock
Esteemed Legend

Like this?

host=host sourcetype="df" "/dev/sda2" | dedup host | table *
0 Karma

manderson7
Contributor

Just about. That shows all the values for a df in the chart, which granted, is what I asked for. I guess what I'd really like to see is, on a scale of 100%, the used percentage of, say, /dev/sda2. I'm hoping to add multiple hosts to this query, and display each w/ a different color on the graph.
Thank you very much for your reply and assistance.

edit: I tried host=host sourcetype="df" "/dev/sda2" | dedup host | table PercentUsedSpace, which shows the correct value in statistics, but nothing in Visualization.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

At .conf26 in Denver, I spent much of my time in conversation with Splunk customers about Splunk AI Assistant. ...

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...