How to create a table for mount point space?

[tmarlette]

I am attempting to build a search which shows the available space for the Unix mount that I desire. These are the standard 'OS' level mount points that I am targeting.

I am attempting to get the column headers to look like this:

host, /, /tmp, /usr/local, /boot
<myhost>,90%,75%,80%,50%

Currently the search i have working is the following:

index=my_index sourcetype=df mount="/" OR mount="/usr/local" OR mount="/opt/" OR mount="/var" OR mount="/tmp" OR mount="/boot" OR mount="/dev" | stats latest(PercentFreeSpace) as "space" by host,mount

This provides the column headers and result set to be as so:

host, mount, space
hostname, /, 70%
hostname,/tmp, 80%

I thought I could maybe use the 'xyseries' function to do this, or maybe the chart function, but I haven't been able to figure it out.

does anyone have any ideas on how to create this in a table?

[tmarlette · Accepted solution]

I figured this one out. See below:

index=my_index sourcetype=df mount="/" OR mount="/usr/local" OR mount="/opt/" OR mount="/var" OR mount="/tmp" OR mount="/boot" OR mount="/dev" | chart latest(PercentFreeSpace) as "space" over host by mount

This is using the default data inputs / field extractions from the Linux TA and Unix app.