Splunk Search

How to edit my search to find server disk space?

cdo_splunk
Splunk Employee
Splunk Employee

This search does not return the correct disk space for a server

| rest splunk_server= /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = capacity - free  | eval pct_usage = floor(usage / capacity * 100)  | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point  | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

do you know any search that return the correct partition disk space?

0 Karma

newbie2tech
Communicator

Hi cdo,

Try this and let us know

| rest /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = capacity - free  | eval pct_usage = floor(usage / capacity * 100)  | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point  | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

If you want to key in specific servers

| rest /services/server/status/partitions-space | where splunk_server="hostnames"| eval free = if(isnotnull(available), available, free) | eval usage = capacity - free | eval pct_usage = floor(usage / capacity * 100) | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...