Splunk Search

Help on formula

jip31
Builder

hi

i use this code to monitore the hdd free space
index="perfmon" sourcetype="perfmon:logicaldisk" instance=c: counter="% Free Space" | eval Value = round(Value, 2). "%" |table _time host Value
but this code give me the free space and not the buzy space
i have 89% free so i would to have instead 11% busy
how can i do please??

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

Can you try subtracting free space from 100. Like, |eval Value=100-round(Value)

View solution in original post

0 Karma

jip31
Builder

thanks it works!

0 Karma

p_gurav
Champion

Can you try subtracting free space from 100. Like, |eval Value=100-round(Value)

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!