How to edit my search to find server disk space?

[cdo_splunk]

This search does not return the correct disk space for a server

| rest splunk_server= /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = capacity - free  | eval pct_usage = floor(usage / capacity * 100)  | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point  | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

do you know any search that return the correct partition disk space?

[newbie2tech]

Hi cdo,

Try this and let us know

| rest /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = capacity - free  | eval pct_usage = floor(usage / capacity * 100)  | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point  | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

If you want to key in specific servers

| rest /services/server/status/partitions-space | where splunk_server="hostnames"| eval free = if(isnotnull(available), available, free) | eval usage = capacity - free | eval pct_usage = floor(usage / capacity * 100) | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"