Splunk Search

How to generate a line chart for disk space by server and hard drive?

New Member

I'm new to Splunk and need some help with a chart for disk space usage. I'm getting the data already in Splunk Light and would like to do a line chart that displays ALL servers and ALL drives in the same chart.

Thanks for your help.

0 Karma
1 Solution

Revered Legend

Depends upon what you want to plot as x-axis value and what as series, try something like this (check the sourcetype name is correct or not)

host on x-axis, and one line for each drive

index=foo sourcetype="Perfmon:Logical Disk" 
| chart avg(Value) over host by instance limit=0

drive on x-axis, and one line for each host

index=foo sourcetype="Perfmon:Logical Disk" 
| chart avg(Value) over instance by host limit=0 | rename instance as drive

View solution in original post

Revered Legend

Depends upon what you want to plot as x-axis value and what as series, try something like this (check the sourcetype name is correct or not)

host on x-axis, and one line for each drive

index=foo sourcetype="Perfmon:Logical Disk" 
| chart avg(Value) over host by instance limit=0

drive on x-axis, and one line for each host

index=foo sourcetype="Perfmon:Logical Disk" 
| chart avg(Value) over instance by host limit=0 | rename instance as drive

View solution in original post

New Member

Thanks for your help. This is what I was looking for.

0 Karma

Revered Legend

Sample events please.

SplunkTrust
SplunkTrust

yes, please post what you have (code and a sample event) so we can be of most help.

0 Karma

New Member

Regular events from perfmon for example:

collection="Free Disk Space"
object=LogicalDisk
counter="% Free Space"
instance=C:
Value=30.601598715187794
host = server1

collection="Free Disk Space"
object=LogicalDisk
counter="% Free Space"
instance=C:
Value=63.5187794
host = server2

server1 has 3 drive letters C:, E:, F:.
server 2 has 1 drive letter C:
server 3 has 3 drive letters C:, D:, E:

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!