Hi, I'm using the following search to monitor disk space. I have 2 partitions, drive D and E. I am only returning results for drive D. I would have expected results for both. Any thoughts are appreciated. thanks
| rest splunk_server=Splunk01 /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = round((capacity - free) / 1024, 2) | eval capacity = round(capacity / 1024, 2) | eval compare_usage = usage." / ".capacity | eval pct_usage = round(usage / capacity * 100, 2) | stats first(fs_type) as fs_type first(compare_usage) as compare_usage first(pct_usage) as pct_usage by mount_point | rename mount_point as "Mount Point", fs_type as "File System Type", compare_usage as "Disk Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Disk Usage (%)"
When you run the rest command by itself, do you see both mount points?
BTW, the rename command references the capacity field, but that field was discarded by stats.
When you run the rest command by itself, do you see both mount points?
BTW, the rename command references the capacity field, but that field was discarded by stats.