I created a simple search: index=index1 sourcetype="Perfmon:Free Disk Space" instance="D:\drive\drive_01" | timechart span=1d max(Value) It shows me the amount of available free space over a certain period. Very useful to determine how fast a drive is filling up. The disadvantage is you have to find the time period in which the drive went from 100% free space to 10% free space (the system leaves some space on the drive before switching to the next drive, so it will never get to 0%). I would like to create a dashboard that will show a graph of the drive and a pull down menu, based on a lookup file (or similar) that allows my Splunk users to look at a drive and see the rate of disk usage over time. I am not an advanced Splunk user, hence posting this question. I can see the process: - Select drive from pulldown list - For selected drive, find point in time where % free space is 98% - For selected drive, find point in time where % free space is 10% or current date/time (if not yet at 10%) - Display line chart graph for the period found Not sure something like that would be possible, but a question not asked is an answer missed 🙂 Thank you!
... View more
