Yes @PickleRick you are correct. Here's an example from a test VM I set up, running Windows, just to illustrate the issue. Under Overview > Resource Usage: Instance > Disk Usage on the Splunk Server, it shows the total and used disk space. In this case, the C: drive is 63.3 GB, with about 31 GB in use, as shown in the screenshot below. My concern with our Ubuntu build (noted in the original question) is around /proc, which is a virtual filesystem and doesn’t actually take up real disk space. However, Splunk seems to include it under resource usage, which could lead to inaccurate reporting especially if Splunk is interpreting virtual usage as real disk usage. That’s why I wanted to blacklist /proc: to ensure only actual disk utilization is shown, excluding virtual filesystems that don’t reflect real storage use. I understand now that this is not a valuable solution but wanted to hopefully find something. I hope this makes sense and thanks everyone for the feedback.
... View more
