Splunk Search

How do you calculate the total disk size in MB?

jip31
Motivator

hello,

I use this query in order to calculate the remaining space in percent.

I also need to calculate the disk size from this source type.

How do I find the disk size from the counter Freespace and Free MB please?

index=perfom sourcetype=perfmon:logicaldisk | where Value <15 
| dedup host 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") | eval Value = round(Value, 1). " %" | rename Value as Free_Space 
| table time host Free_Space | sort -Free_Space limit=10
Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

You can do eval Value= Value/1024/1024, that will be in MB, and one more Value/1024/1024/1024 will be GB.

index=perfom sourcetype=perfmon:logicaldisk | where Value <15 
 | dedup host 
 | eval time = strftime(_time, "%m/%d/%Y %H:%M") 
 | eval Value= Value/1024/1024
 | eval Value = round(Value, 1). " %" 
 | rename Value as Free_Space 
 | table time host Free_Space | sort -Free_Space limit=10
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

jip31
Motivator

thanks but it's not what I want
i want to know if its possible to find the size disk in MB from the fcounter free space and free mb

0 Karma

inventsekar
SplunkTrust
SplunkTrust

i want to know if its possible to find the size disk in MB from the fcounter free space and free mb /// i am not sure how to do that. if you let us know the logic, then we can write the query.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...