Splunk Search

Show percentage on pie chart out of 100%

trever
Loves-to-Learn

I have event logs with a % in them and I want to break them apart and show them on their own:

My event log looks like this:

Tue May  5 12:55:01 PDT 2020
/dev/sde2        9460988  7233068   1751044  81% /Volumes/Media 2
/dev/sdc1       13245631 12470714    107304 100% /Volumes/Media

Id like to turn it into this:

alt text

But with it showing the %'s as a total out of 100% (so 100% used and 81% used)

0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="Tue May  5 12:55:01 PDT 2020
 /dev/sde2        9460988  7233068   1751044  81% /Volumes/Media 2
 /dev/sdc1       13245631 12470714    107304 100% /Volumes/Media"
| multikv noheader=t
| tail 2
| fields _raw
| rex "(?<device>\S+)\s+(?<total>\S+)\s+(?<usage>\S+)\s+(?<rest>\S+)\s+(?<perc>\S+)\s+(?<media>.*)"
| table device total usage rest perc media
| rename COMMENT as "this is sample"
| table device usage rest
| untable device disk_usage value
| stats values(value) as value by device disk_usage

alt text

sorry, I can't display 100%

0 Karma

tauliang
Communicator
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!