Splunk Search

df by host,mount

cmeo
Contributor

I'm trying to set up a timechart of disk free by host and mountpoint and this is proving difficult, because timechart will only accept one field for a by clause. This doesn't work because the level of uniqueness is host,mount not host or mount. Let me additionally say I loathed the new version of the NIX app on sight and can't stand the new visualisations. The old versions--which I can't download any more for pointers--did the job fine in my opinion. So all I want is for something like this to work:

sourcetype=df| timechart span=1h avg(storage_percent_free) AS pctfree by host, mount

and make a nice, old school line chart which you can extrapolate easily...like the old version did.

Anyone know how I get there?

Tags (2)
0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

Or something like this?

sourcetype=df index=os | eval hostmount=host.":".mount | timechart avg(storage_free_percent) by hostmount usenull=f

MuS
SplunkTrust
SplunkTrust

Hi cmeo,

you can use chart instead to do this:

 sourcetype=df | chart span=1h values(mount) AS mount avg(storage_percent_free) AS pctfree over _time by host

should do the job for you.

cheers, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...