Splunk Search

Sorting/Arranging chart results



I have the below query which is used to find the total and used diskspace of a linux server. I need to arrange the results something like below. Please help me with the query

MountedOn  Size:abc Used_DS:abc Size:def Used_DS:abc

Query used:

index=test sourcetype="df"
| sort _time 
| multikv 
| rex field="Used" "^(?[\d.]*)(?\w+)$" 
| rex field="Size" "^(?[\d.]*)(?\w+)$" 
| eval Used=if(GB_MB="M", round(Used1/1024,2), round(Used1,2)), Size=if(GB_MB1="M", round(Size1/1024,2), round(Size1,2)) 
| stats latest(Used) AS "Usedable_DiskSpace", latest(Size) AS Size by host, MountedOn 
| chart values(Usedable_DiskSpace) as Used_DS, values(Size) AS Size over MountedOn by host limit=0 
| eval 
| fillnull value="0 G"

Current results:

MountedOn Size:abc Size:def Used_DS:abc Used_DS:def
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...