We run a report every week that counts how many times a firewall policy was used. (A firewall policy is represented by a number) What I would like to do is compare a master list of all the firewall policies that exist against policies that never show up in the logs. If a policy doesn't show up in the logs, then it obviously isn't being used. Would I use a lookup for this? Would I set up the master list of policies somewhere, then somehow search the logs to see which ones are NOT in the logs? How would I go about achieving something like this? Thanks! ... View more

I'd like to have one column chart showing the percentage of drive space taken on each of the drives in the screenshot. I wouldn't want "_total", but I would want the other 3. How would I accomplish this? Thanks! ... View more

I'd like to set up pie charts for disk space from data coming from the "df" scripts from the UNIX app. In looking through the charting docs, I can see how to chart "count" data, but I am unclear how to chart a single value, coming from the "df" script. I tried the "transpose" command, but only "UsedG" is coming up on the chart. The search below was developed with help from the Splunk Answers KB. Notice that we convert the "Used" field to gigabytes. It goes to a field called "UsedG", but this seems to screw up the table. It adds "UsedG" to the table, even though it is not defined in the search. I basically want to use "Used" and "Available", which should give a complete pie chart. If there was a way to chart "Size" and "Used", that would probably be more accurate. Thanks for the help! host="myhost" sourcetype="df" | multikv fields Filesystem Type Size Used Avail UsePct MountedOn | search /home | table MountedOn Size Used Avail | eval UsedG = case(match(Used,"[M]"),round(tonumber(rtrim(Used,"M"))/1024,3), match(Used,"[T]"),round(tonumber(rtrim(Used,"T"))*1024,3), match(Used,"[G]"),round(tonumber(rtrim(Used,"G")),3)) ... View more