Can I chart the available disk space?

Question

Hi Guys

I am trying to make a chart of disk space used over time but the query I have built (below) simply returns a result of '1' indicating that a value is present, how can I extract the value of 'Value' to use in a chart?

Here is an example of the data:

06/14/2011 12:30:59.466
collection="Free Disk Space"
object=LogicalDisk
counter="Free Megabytes"
instance=E:
Value=134341
host=ROMERO Options| sourcetype=Perfmon:Free Disk Space

Using this query:

host="romero" source="Perfmon:Free Disk Space" | timechart values(Value) as FreeSpace

I get a result that looks like this:

6/8/11 12:00:00.000 AM
134679 134681 134687 134691

6/9/11 12:00:00.000 AM
134529 134530 134531 134532 ... etc

When I chart this result, each Value, is shown on the chart with a value of '1' so each time-frame simply shows the number of values in that time period, which is the same every time period obviously, rather than using the actual values to draw the chart to show how much space is being used.

Is it possible extract these values for use in a chart?

Thanks :)

Answer 1

Sure. First, some explanation for how timechart behaves: timechart needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:

host="romero" source="Perfmon:Free Disk Space" | timechart span=1m avg(Value) as FreeSpace

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

host="romero" source="Perfmon:Free Disk Space" | table _time Values

Can I chart the available disk space?

Follow this question

Splunk Resources

Related questions