Splunk Search

Display disk space usage in chart format

manderson7
Contributor

I am able to display disk space via the Pie Chart visualization, but I'd like to display w/ a chart, like what's in this vmware dashboard:
http://blogs.splunk.com/wp-content/uploads/2012/06/splunkx_dash_02.jpg

host=host sourcetype="df" "/dev/sda2" | dedup host | chart

I think that's how I want to start, but don't know how to finish. Thanks much for any help.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Based on your last comment to my first answer, do this:

 host=host sourcetype="df" "/dev/sda2" | dedup host | chart avg(PercentUsedSpace) by host

When you use table it tells Splunk not to attempt a visualization whereas chart implies a visualization and tells Splunk to attempt to do so.

View solution in original post

woodcock
Esteemed Legend

Based on your last comment to my first answer, do this:

 host=host sourcetype="df" "/dev/sda2" | dedup host | chart avg(PercentUsedSpace) by host

When you use table it tells Splunk not to attempt a visualization whereas chart implies a visualization and tells Splunk to attempt to do so.

woodcock
Esteemed Legend

Like this?

host=host sourcetype="df" "/dev/sda2" | dedup host | table *
0 Karma

manderson7
Contributor

Just about. That shows all the values for a df in the chart, which granted, is what I asked for. I guess what I'd really like to see is, on a scale of 100%, the used percentage of, say, /dev/sda2. I'm hoping to add multiple hosts to this query, and display each w/ a different color on the graph.
Thank you very much for your reply and assistance.

edit: I tried host=host sourcetype="df" "/dev/sda2" | dedup host | table PercentUsedSpace, which shows the correct value in statistics, but nothing in Visualization.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

To help practitioners build a stronger foundation, we launched the Data Management & Federation ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...