Splunk Search

How to use results from one search to create a timechart?

Stefanie
Builder

I am in the process of creating a search to detect significant hard drive decreases. 

Using the results from my search, I would like to then create a timechart to show how the usage has changed over time. 

This is my search: 

 

index=perfmon collection=LogicalDisk sourcetype="Perfmon:LogicalDisk" counter="% Free Space" (instance!="HarddiskVolume*") (instance!=_Total)
| eval usedSpace=round(100-Value,0) 
|stats min(usedSpace) as min, avg(usedSpace) as avg by host, instance
|eval delta = avg - min
|where delta>10
|rename instance as drive

 

 

 My results return the hostname, the drive letter, the minimum, the average, and the delta for the disk space usage in a tabular format.

 

Let's say it returns one host, I would then like to use that same host to return a timechart for the host and drive.

 

Is this possible?

 

 

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Stefanie,

after a stats command you have only the fields in the stats, in your case min, avg, host and instance, you don't have more _time

So you have to put also -time in you stats, but before of this you have to group _time using the bin command.

So you could try something like this:

index=perfmon collection=LogicalDisk sourcetype="Perfmon:LogicalDisk" counter="% Free Space" (instance!="HarddiskVolume*") (instance!=_Total)
| eval usedSpace=round(100-Value,0) 
| rename instance as drive
| bin span=1d _time
| stats min(usedSpace) AS min avg(usedSpace) AS avg BY host drive _time
| eval delta = avg - min
| where delta>10
| eval column=host." ".drive
| timechart max(delta) AS max_delta BY column

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Stefanie,

after a stats command you have only the fields in the stats, in your case min, avg, host and instance, you don't have more _time

So you have to put also -time in you stats, but before of this you have to group _time using the bin command.

So you could try something like this:

index=perfmon collection=LogicalDisk sourcetype="Perfmon:LogicalDisk" counter="% Free Space" (instance!="HarddiskVolume*") (instance!=_Total)
| eval usedSpace=round(100-Value,0) 
| rename instance as drive
| bin span=1d _time
| stats min(usedSpace) AS min avg(usedSpace) AS avg BY host drive _time
| eval delta = avg - min
| where delta>10
| eval column=host." ".drive
| timechart max(delta) AS max_delta BY column

Ciao.

Giuseppe

Stefanie
Builder

@gcusello  You are a wizard! Thank you so much!! 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...