How can I get UsePct

[leov123]

Please tell me know how can I get UsePct data?

I must get the UsePct data which the MountedOn="/tmp" . Already type like below:

index=* sourcetype=df MountedOn="/tmp"
|table host,UsePct

But that hav't any result of UsePct.
Please help me.

I try type like below, but still not good..........

index=* source=df "/tmp"
| multikv fields Filesystem Avail UsePct
| table host,UsePct

Please.......help me....

[adonio · Accepted solution]

you can use either fields Mount or MountedOn and then use the PercentUsedSpace or PercentFreeSpace fields
verify you have them and so something like this:
index=os sourcetype=df MountedOn="\tmp" | stats latest(PercentFreeSpace) as last_free Avg(PercentFreeSpace) as avg_free ... by host

[leov123]

Thank you for your answer.

But when I use Mounted or Mount in the Search

the result of Events and Statistics is "No results found. Try expanding the time range. "

However, only type in
index=* sourcetype=df "tmp"
I can get some data of the result

Finally...I type like below

index=* sourcetype=df "/tmp"
| stats latest(PercentUsedSpace) as last_free Avg(PercentUsedSpace) as avg_free by host
| table host,last_free,avg_free

But the last_free and avg_free in table of Statistics still empty.........

[adonio]

do you see the relevant fields? PercentUsedSpace PercentFreeSpace

[leov123]

Oh, that's why......
My main language isn't English, I got you wrong.

Let me check the relevant fields.......

Thank you very much

[adonio]

are you using the Nix TA?

[leov123]

yes....but the linux...

Could you help me?

It's driving me nuts...........