Hi,
I have the below query which is used to find the total and used diskspace of a linux server. I need to arrange the results something like below. Please help me with the query
MountedOn Size:abc Used_DS:abc Size:def Used_DS:abc
Query used:
index=test sourcetype="df"
| sort _time
| multikv
| rex field="Used" "^(?[\d.]*)(?\w+)$"
| rex field="Size" "^(?[\d.]*)(?\w+)$"
| eval Used=if(GB_MB="M", round(Used1/1024,2), round(Used1,2)), Size=if(GB_MB1="M", round(Size1/1024,2), round(Size1,2))
| stats latest(Used) AS "Usedable_DiskSpace", latest(Size) AS Size by host, MountedOn
| chart values(Usedable_DiskSpace) as Used_DS, values(Size) AS Size over MountedOn by host limit=0
| eval
| fillnull value="0 G"
Current results:
MountedOn Size:abc Size:def Used_DS:abc Used_DS:def
