Splunk Search

Pie chart syntax for disk use

fsrodriguez
New Member

I have the values I just don't have the syntax.

host="app-1" source="df" | stats max(storage_used) as storage_used by host 

Where do I include: max(TotalMBytes)?

Not sure how to convert that into a pie chart.

Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @fsrodriguez,

With your provided search I think you are looking for like below search.

host="app-1" source="df" 
| stats max(storage_used) as storage_used max(TotalMBytes) as TotalMBytes
| eval storage_unused=(TotalMBytes-storage_used) 
| table storage_used storage_unused 
| transpose

Convert viz to a pie chart. Bytes to GB is pending in this search.

Another thing I'm guessing you want the latest status of disk volume of the particular host. So can you please try the search?

host="app-1" source="df" | head 1 |
| eval storage_unused=(TotalMBytes-storage_used) 
| table storage_used storage_unused 
| transpose

Convert viz to a pie chart. Bytes to GB is pending in this search.

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @fsrodriguez,

With your provided search I think you are looking for like below search.

host="app-1" source="df" 
| stats max(storage_used) as storage_used max(TotalMBytes) as TotalMBytes
| eval storage_unused=(TotalMBytes-storage_used) 
| table storage_used storage_unused 
| transpose

Convert viz to a pie chart. Bytes to GB is pending in this search.

Another thing I'm guessing you want the latest status of disk volume of the particular host. So can you please try the search?

host="app-1" source="df" | head 1 |
| eval storage_unused=(TotalMBytes-storage_used) 
| table storage_used storage_unused 
| transpose

Convert viz to a pie chart. Bytes to GB is pending in this search.

Thanks

0 Karma

fsrodriguez
New Member

wow that looks awesome! Thank you soo much! I appreciate the help!

0 Karma

micahkemp
Champion

A pie chart is only going to work with one value broken out by label, and needs to be split by that label. Try something like:

host="app-1" source="df" | timechart max(storage_used) BY filesystem
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...