Hi,
I have 2 searches, for 1st output is values (2GB) and other gives output as percent (2%) .
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="Free Megabytes" instance!=_Total| eval Value=(Value/1024)|eval Value= round(Value,2)|chart values(Value) by host, instance
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="% Free Space" instance!=_Total|eval Value= round(Value,2)|chart values(Value) by host,instance
I want output to show values as well as percent for the host and instance (C/D)...
Any ideas will be appreciated 🙂
Thanks
hi shreyasathavale,
try something like this:
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="Free Megabytes" instance!=_Total
| eval Value=round(Value/1024,2)
| stats values(Value) AS "Free Megabytes" by host, instance
| append [ search
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="% Free Space" instance!=_Total
| eval Value=round(Value,2)
| stats values(Value) AS "% Free Space" by host, instance
]
| stats values("Free Megabytes") AS "Free Megabytes" values("% Free Space") AS "% Free Space" by host, instance
Bye.
Giuseppe
Like this:
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC (counter="Free Megabytes" OR counter="% Free Space") instance!=_Total
| eval Value=if((counter="Free Megabytes", Value/1024, round(Value,2)) | chart values(Value) by host, instance
Try like this.
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="Free Megabytes" OR counter="% Free Space" instance!=_Total|eval Value= round(Value/1024,2) | eval instance=instance.":".counter|chart values(Value) by host, instance
you could do:
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="Free Megabytes" instance!=_Total| eval Value=(Value/1024)|eval Value= round(Value,2)|chart values(Value) by host, instance|join type=left host [search index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="% Free Space" instance!=_Total|eval Value= round(Value,2)|chart values(Value) by host,instance]
but that has limitations with the join, or you could try this:
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC (counter="Free Megabytes" OR counter="% Free Space") instance!=_Total |eval Value=if(counter="Free Megabytes",round((Value/1024),2),round(Value,2))
|chart values(Value) by host, instance
hi shreyasathavale,
try something like this:
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="Free Megabytes" instance!=_Total
| eval Value=round(Value/1024,2)
| stats values(Value) AS "Free Megabytes" by host, instance
| append [ search
index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="% Free Space" instance!=_Total
| eval Value=round(Value,2)
| stats values(Value) AS "% Free Space" by host, instance
]
| stats values("Free Megabytes") AS "Free Megabytes" values("% Free Space") AS "% Free Space" by host, instance
Bye.
Giuseppe
Thanks Guiseppe, I was going for "join" but append is anytime better 🙂
The append
command has the same downsides as join
does. Did you try any of the answers that do not use either?