The "latest disk used by host" is populated by the following query in this file: /opt/splunk/etc/apps/unix/default/data/ui/views/disk_used_by_host.xml [Latest_Disk_Used_by_Host(1)] args = host definition = index="os" sourcetype="df" | dedup host it could be replaced by: [Latest_Disk_Used_by_Host(1)] args = host definition = index="os" sourcetype="df" host=$host$ | dedup host ... View more