Splunk Search

How do you calculate the total disk size in MB?

jip31
Motivator

hello,

I use this query in order to calculate the remaining space in percent.

I also need to calculate the disk size from this source type.

How do I find the disk size from the counter Freespace and Free MB please?

index=perfom sourcetype=perfmon:logicaldisk | where Value <15 
| dedup host 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") | eval Value = round(Value, 1). " %" | rename Value as Free_Space 
| table time host Free_Space | sort -Free_Space limit=10
Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

You can do eval Value= Value/1024/1024, that will be in MB, and one more Value/1024/1024/1024 will be GB.

index=perfom sourcetype=perfmon:logicaldisk | where Value <15 
 | dedup host 
 | eval time = strftime(_time, "%m/%d/%Y %H:%M") 
 | eval Value= Value/1024/1024
 | eval Value = round(Value, 1). " %" 
 | rename Value as Free_Space 
 | table time host Free_Space | sort -Free_Space limit=10
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

jip31
Motivator

thanks but it's not what I want
i want to know if its possible to find the size disk in MB from the fcounter free space and free mb

0 Karma

inventsekar
SplunkTrust
SplunkTrust

i want to know if its possible to find the size disk in MB from the fcounter free space and free mb /// i am not sure how to do that. if you let us know the logic, then we can write the query.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...