Splunk Search

Display disk space usage in chart format

manderson7
Contributor

I am able to display disk space via the Pie Chart visualization, but I'd like to display w/ a chart, like what's in this vmware dashboard:
http://blogs.splunk.com/wp-content/uploads/2012/06/splunkx_dash_02.jpg

host=host sourcetype="df" "/dev/sda2" | dedup host | chart

I think that's how I want to start, but don't know how to finish. Thanks much for any help.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Based on your last comment to my first answer, do this:

 host=host sourcetype="df" "/dev/sda2" | dedup host | chart avg(PercentUsedSpace) by host

When you use table it tells Splunk not to attempt a visualization whereas chart implies a visualization and tells Splunk to attempt to do so.

View solution in original post

woodcock
Esteemed Legend

Based on your last comment to my first answer, do this:

 host=host sourcetype="df" "/dev/sda2" | dedup host | chart avg(PercentUsedSpace) by host

When you use table it tells Splunk not to attempt a visualization whereas chart implies a visualization and tells Splunk to attempt to do so.

woodcock
Esteemed Legend

Like this?

host=host sourcetype="df" "/dev/sda2" | dedup host | table *
0 Karma

manderson7
Contributor

Just about. That shows all the values for a df in the chart, which granted, is what I asked for. I guess what I'd really like to see is, on a scale of 100%, the used percentage of, say, /dev/sda2. I'm hoping to add multiple hosts to this query, and display each w/ a different color on the graph.
Thank you very much for your reply and assistance.

edit: I tried host=host sourcetype="df" "/dev/sda2" | dedup host | table PercentUsedSpace, which shows the correct value in statistics, but nothing in Visualization.

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...