Splunk Search

How do you calculate the total disk size in MB?

jip31
Motivator

hello,

I use this query in order to calculate the remaining space in percent.

I also need to calculate the disk size from this source type.

How do I find the disk size from the counter Freespace and Free MB please?

index=perfom sourcetype=perfmon:logicaldisk | where Value <15 
| dedup host 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") | eval Value = round(Value, 1). " %" | rename Value as Free_Space 
| table time host Free_Space | sort -Free_Space limit=10
Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

You can do eval Value= Value/1024/1024, that will be in MB, and one more Value/1024/1024/1024 will be GB.

index=perfom sourcetype=perfmon:logicaldisk | where Value <15 
 | dedup host 
 | eval time = strftime(_time, "%m/%d/%Y %H:%M") 
 | eval Value= Value/1024/1024
 | eval Value = round(Value, 1). " %" 
 | rename Value as Free_Space 
 | table time host Free_Space | sort -Free_Space limit=10
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

jip31
Motivator

thanks but it's not what I want
i want to know if its possible to find the size disk in MB from the fcounter free space and free mb

0 Karma

inventsekar
SplunkTrust
SplunkTrust

i want to know if its possible to find the size disk in MB from the fcounter free space and free mb /// i am not sure how to do that. if you let us know the logic, then we can write the query.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...