This variation of the partition-space search previously mentioned might work for you, this particular search is from within the monitoring consoles so should work. Infact for me it does return the co...
See more...
This variation of the partition-space search previously mentioned might work for you, this particular search is from within the monitoring consoles so should work. Infact for me it does return the correct space for the "/" mount point. | rest splunk_server=* /services/server/status/partitions-space
| eval free = if(isnotnull(available), available, free)
| eval usage = round((capacity - free) / 1024, 2)
| eval capacity = round(capacity / 1024, 2)
| eval compare_usage = usage." / ".capacity
| eval pct_usage = round(usage / capacity * 100, 2)
| stats first(fs_type) as fs_type first(compare_usage) AS compare_usage first(pct_usage) as pct_usage by mount_point
| rename mount_point as "Mount Point", fs_type as "File System Type", compare_usage as "Disk Usage (GB)", pct_usage as "Disk Usage (%)" I think Ive had issues in the past where people havent implemented this endpoint correctly and havent split the stats by mount_point, which can mean you get broken stats based on a number of different mount points! Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will