Splunk 5.0.2
Example: windows "Perfmon:Free Disk Space"
Each check is actually two events, one with the free space in MD, one in percent like this:
search: source="Perfmon:Free Disk Space"
first two results:
05/17/2013 08:59:29.087<br>
collection="Free Disk Space"<br>
object=LogicalDisk<br>
counter="% Free Space"<br>
instance=_Total<br>
Value=23.842293475974397<br>
05/17/2013 08:59:29.087<br>
collection="Free Disk Space"<br>
object=LogicalDisk<br>
counter="Free Megabytes"<br>
instance=_Total<br>
Value=31736<br>
I make these into transactions to bring this information together:
Search: source="Perfmon:Free Disk Space" | transaction host instance _time
first result:
05/17/2013 09:00:59.656<br>
collection="Free Disk Space"<br>
object=LogicalDisk<br>
counter="Free Megabytes"<br>
instance=_Total<br>
Value=121005<br>
05/17/2013 09:00:59.656<br>
collection="Free Disk Space"<br>
object=LogicalDisk<br>
counter="% Free Space"<br>
instance=_Total<br>
Value=20.732246391710184<br>
If I could rename the "Value" field to the value of the "counter" field before my transaction command I would have something along the lines of::
05/17/2013 09:00:59.656<br>
collection="Free Disk Space"<br>
object=LogicalDisk<br>
counter="Free Megabytes"<br>
instance=_Total<br>
Free Megabytes=121005<br>
05/17/2013 09:00:59.656<br>
collection="Free Disk Space"<br>
object=LogicalDisk<br>
counter="% Free Space"<br>
instance=_Total<br>
% Free Space=20.732246391710184<br>
I could then make tables charts graphs alerts etc based on those values and have both the space in megabytes and the percent available. For example, on a drive with multiple terabytes of disk space, 10% free isn't that big a deal but only having a few thousand meg free would be an issue, on a drive with only a few dozen gigabytes 10% free may be critical where a few thousand megabytes is "normal"
I know I could use a case argument but that only adresses this one instance, I'm looking for a tool I can use again in the future.
the closest i've come is this:
Search: source="Perfmon:Free Disk Space" | chart first(Value) over host by counter
give me <Hostname> <% Free Space> <Free Megabytes>
which is "ok" but doesn't account for multiple instances (in this example, i have an instance for each drive then one for _Total )
... View more