Splunk Search

How to edit my search to find server disk space?

Splunk Employee
Splunk Employee

This search does not return the correct disk space for a server

| rest splunk_server= /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = capacity - free  | eval pct_usage = floor(usage / capacity * 100)  | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point  | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

do you know any search that return the correct partition disk space?

0 Karma

Communicator

Hi cdo,

Try this and let us know

| rest /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = capacity - free  | eval pct_usage = floor(usage / capacity * 100)  | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point  | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

If you want to key in specific servers

| rest /services/server/status/partitions-space | where splunk_server="hostnames"| eval free = if(isnotnull(available), available, free) | eval usage = capacity - free | eval pct_usage = floor(usage / capacity * 100) | stats first(fs_type) as fs_type first(capacity) as capacity first(usage) as usage first(pct_usage) as pct_usage by mount_point | eval usage=round(usage / 1024, 2) | eval capacity=round(capacity / 1024, 2) | rename mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!