I'm trying to set up a timechart of disk free by host and mountpoint and this is proving difficult, because timechart will only accept one field for a by clause. This doesn't work because the level of uniqueness is host,mount not host or mount. Let me additionally say I loathed the new version of the NIX app on sight and can't stand the new visualisations. The old versions--which I can't download any more for pointers--did the job fine in my opinion. So all I want is for something like this to work:
sourcetype=df| timechart span=1h avg(storage_percent_free) AS pctfree by host, mount
and make a nice, old school line chart which you can extrapolate easily...like the old version did.
Anyone know how I get there?
Or something like this?
sourcetype=df index=os | eval hostmount=host.":".mount | timechart avg(storage_free_percent) by hostmount usenull=f
Hi cmeo,
you can use chart instead to do this:
sourcetype=df | chart span=1h values(mount) AS mount avg(storage_percent_free) AS pctfree over _time by host
should do the job for you.
cheers, MuS