Splunk Search

Multiple statistics for multiple linux servers, How do I write the query?

mike000
New Member

I tried:
index=_nix_xxxx sourcetype=df host=abdhw003 MountedOn="/doc" |eval source="/doc*" and that seems to show the data of the /doc folder

Now I have multiple servers and I need stats on all the servers seperately whichever server has >5% used. Please see example below. But when i run the below command then All the servers are adding up ad its showing me a 1 liner with all server info merged. I think I messed up in the stats algorithm. Please help.

index=_nix_xxxx sourcetype=df host=abdhw003 OR host=n OR host=n OR host=n or host=n MountedOn="/doc"| eval TotalGBytes= TotalMBytes/1024 | eval UsedGBytes=UsedMbytes/1024 |eval used_pct=100(UsedGBytes/TotalGBytes) | stats max(TotalGBytes) as "MaxSize(GB) max(UsedGBytes) as "UsedSize(GB) as "percentUsed" by MountedOn | search PercentUsed>05| Sort PercentUsed

Now the stats that I am getting is getting totalled(All 5 servers adding each other and showing me a max value) I think as the stats query has max value, How do I show stats of each server at a time? Any Ideas?

Thanks for the help. I appreciate it

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this:

index=_nix_xxxx sourcetype=df host=abdhw003 OR host=n OR host=n OR host=n or host=n MountedOn="/doc"
| eval TotalGBytes= TotalMBytes/1024 | eval UsedGBytes=UsedMbytes/1024 |eval used_pct=100(UsedGBytes/TotalGBytes) 
| stats max(TotalGBytes) as "MaxSize(GB) max(UsedGBytes) as "UsedSize(GB) as "percentUsed" by host, MountedOn 
| search PercentUsed>05| Sort PercentUsed
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

index="_nix_xxxx" AND sourcetype="df" AND (host="abdhw003" OR host="x" OR host="y" OR host="z" or host="etc") AND MountedOn="/doc"
| stats max(TotalMBytes) AS max_TotalMBytes max(UsedMBytes) AS max_UsedMBytes avg(PercentUsedSpace) AS PercentUsed BY MountedOn 
| search PercentUsed>05 
| eval TotalGBytes = max_TotalMBytes / 1024
| eval UsedGBytes = max_UsedMBytes / 1024
| eval used_pct = 100 * (max_UsedMBytes / max_TotalMBytes)
| fields - TotalGBytes UsedGBytes
| sort 0 PercentUsed

As a bonus, try this search, use the Linechart visualization, turn on Trellis feature and select host for split by:

index="os" AND sourcetype="df" 
| eval FS_{Filesystem}=PercentUsedSpace
| timechart limit=0 [search index="os" AND sourcetype="df" earliest=-4h latest=now
| stats count BY Filesystem
| rename Filesystem AS max
| eval max = "FS_" . max
| eval zAS = max
| table max zAS
| format "" "" ")" "" "" ""
| rex field=search mode=sed "s/=\"/(/g s/\" \) zAS\(FS_/) AS /g s/\"\s+max/ max/g s/\"\s+$//"] BY host
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this:

index=_nix_xxxx sourcetype=df host=abdhw003 OR host=n OR host=n OR host=n or host=n MountedOn="/doc"
| eval TotalGBytes= TotalMBytes/1024 | eval UsedGBytes=UsedMbytes/1024 |eval used_pct=100(UsedGBytes/TotalGBytes) 
| stats max(TotalGBytes) as "MaxSize(GB) max(UsedGBytes) as "UsedSize(GB) as "percentUsed" by host, MountedOn 
| search PercentUsed>05| Sort PercentUsed
---
If this reply helps you, Karma would be appreciated.
0 Karma

mike000
New Member

Thank you soo much, that worked like a charm. Much appreciated Rich, you rock!!!!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...