Knowledge Management

Example of how to measure server disk usage?

sloshburch
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk to measure server disk usage?

Tags (1)
0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information about this example see Operating System Module KPIs and thresholds in the Splunk IT Service Intelligence Modules manual.

System Administration teams need to know when servers are running out of disk space to avoid potential issues. Set up server and operating system (OS) monitoring for your environment and leverage the search in this example use case to pinpoint errors, prevent business outages through the monitoring of CPU, memory, disk, and network metrics.

Load data

How to implement: This example use case depends on data from operating system events.

Complete the following steps to set up this example use case:

  1. Install and configure the Splunk Add-on for Microsoft Windows .
  2. Install and configure the Splunk Add-on Unix and Linux.
  3. Enable the basic data collection for storage usage with the [script://./bin/df.sh] input of the Splunk Add-on for Unix and Linux and/or the [perfmon://LogicalDisk] input of the Splunk Add-on for Microsoft Windows.

Review the following resources for more details:

Best practic For more granular results with scripted inputs, you can increase the frequency at which the input runs using the interval setting in inputs.conf. Running the input more frequently consumes more storage, and running it less frequently uses less, which can affect license consumption. The default interval is 60 seconds. See Scripted Input in the input.conf topic of the Splunk Enterprise Admin manual.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Get insights

Run the following search.

index=* tag=oshost tag=performance tag=storage 
| chart usenull=false limit=0 min(storage_free_percent) OVER host BY mount

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

The Operating System Module troubleshooting section in the Splunk IT Service Intelligence Modules manual lists troubleshooting resources that you can apply to this example use case.

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information about this example see Operating System Module KPIs and thresholds in the Splunk IT Service Intelligence Modules manual.

System Administration teams need to know when servers are running out of disk space to avoid potential issues. Set up server and operating system (OS) monitoring for your environment and leverage the search in this example use case to pinpoint errors, prevent business outages through the monitoring of CPU, memory, disk, and network metrics.

Load data

How to implement: This example use case depends on data from operating system events.

Complete the following steps to set up this example use case:

  1. Install and configure the Splunk Add-on for Microsoft Windows .
  2. Install and configure the Splunk Add-on Unix and Linux.
  3. Enable the basic data collection for storage usage with the [script://./bin/df.sh] input of the Splunk Add-on for Unix and Linux and/or the [perfmon://LogicalDisk] input of the Splunk Add-on for Microsoft Windows.

Review the following resources for more details:

Best practic For more granular results with scripted inputs, you can increase the frequency at which the input runs using the interval setting in inputs.conf. Running the input more frequently consumes more storage, and running it less frequently uses less, which can affect license consumption. The default interval is 60 seconds. See Scripted Input in the input.conf topic of the Splunk Enterprise Admin manual.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Get insights

Run the following search.

index=* tag=oshost tag=performance tag=storage 
| chart usenull=false limit=0 min(storage_free_percent) OVER host BY mount

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

The Operating System Module troubleshooting section in the Splunk IT Service Intelligence Modules manual lists troubleshooting resources that you can apply to this example use case.

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...