Splunk Search

How to use results from one search to create a timechart?

Stefanie
Builder

I am in the process of creating a search to detect significant hard drive decreases. 

Using the results from my search, I would like to then create a timechart to show how the usage has changed over time. 

This is my search: 

 

index=perfmon collection=LogicalDisk sourcetype="Perfmon:LogicalDisk" counter="% Free Space" (instance!="HarddiskVolume*") (instance!=_Total)
| eval usedSpace=round(100-Value,0) 
|stats min(usedSpace) as min, avg(usedSpace) as avg by host, instance
|eval delta = avg - min
|where delta>10
|rename instance as drive

 

 

 My results return the hostname, the drive letter, the minimum, the average, and the delta for the disk space usage in a tabular format.

 

Let's say it returns one host, I would then like to use that same host to return a timechart for the host and drive.

 

Is this possible?

 

 

Labels (4)
0 Karma
1 Solution

gcusello
Legend

Hi @Stefanie,

after a stats command you have only the fields in the stats, in your case min, avg, host and instance, you don't have more _time

So you have to put also -time in you stats, but before of this you have to group _time using the bin command.

So you could try something like this:

index=perfmon collection=LogicalDisk sourcetype="Perfmon:LogicalDisk" counter="% Free Space" (instance!="HarddiskVolume*") (instance!=_Total)
| eval usedSpace=round(100-Value,0) 
| rename instance as drive
| bin span=1d _time
| stats min(usedSpace) AS min avg(usedSpace) AS avg BY host drive _time
| eval delta = avg - min
| where delta>10
| eval column=host." ".drive
| timechart max(delta) AS max_delta BY column

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @Stefanie,

after a stats command you have only the fields in the stats, in your case min, avg, host and instance, you don't have more _time

So you have to put also -time in you stats, but before of this you have to group _time using the bin command.

So you could try something like this:

index=perfmon collection=LogicalDisk sourcetype="Perfmon:LogicalDisk" counter="% Free Space" (instance!="HarddiskVolume*") (instance!=_Total)
| eval usedSpace=round(100-Value,0) 
| rename instance as drive
| bin span=1d _time
| stats min(usedSpace) AS min avg(usedSpace) AS avg BY host drive _time
| eval delta = avg - min
| where delta>10
| eval column=host." ".drive
| timechart max(delta) AS max_delta BY column

Ciao.

Giuseppe

Stefanie
Builder

@gcusello  You are a wizard! Thank you so much!! 

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...