Splunk Search

Show percentage on pie chart out of 100%

trever
Loves-to-Learn

I have event logs with a % in them and I want to break them apart and show them on their own:

My event log looks like this:

Tue May  5 12:55:01 PDT 2020
/dev/sde2        9460988  7233068   1751044  81% /Volumes/Media 2
/dev/sdc1       13245631 12470714    107304 100% /Volumes/Media

Id like to turn it into this:

alt text

But with it showing the %'s as a total out of 100% (so 100% used and 81% used)

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="Tue May  5 12:55:01 PDT 2020
 /dev/sde2        9460988  7233068   1751044  81% /Volumes/Media 2
 /dev/sdc1       13245631 12470714    107304 100% /Volumes/Media"
| multikv noheader=t
| tail 2
| fields _raw
| rex "(?<device>\S+)\s+(?<total>\S+)\s+(?<usage>\S+)\s+(?<rest>\S+)\s+(?<perc>\S+)\s+(?<media>.*)"
| table device total usage rest perc media
| rename COMMENT as "this is sample"
| table device usage rest
| untable device disk_usage value
| stats values(value) as value by device disk_usage

alt text

sorry, I can't display 100%

0 Karma

tauliang
Communicator
0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...