I am trying to make a chart of disk space used over time but the query I have built (below) simply returns a result of '1' indicating that a value is present, how can I extract the value of 'Value' to use in a chart?
Here is an example of the data:
Using this query:
host="romero" source="Perfmon:Free Disk Space" | timechart values(Value) as FreeSpace
I get a result that looks like this:
6/8/11 12:00:00.000 AM
6/9/11 12:00:00.000 AM
When I chart this result, each Value, is shown on the chart with a value of '1' so each time-frame simply shows the number of values in that time period, which is the same every time period obviously, rather than using the actual values to draw the chart to show how much space is being used.
Is it possible extract these values for use in a chart?
asked 13 Jun '11, 19:49
Sure. First, some explanation for how
Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats
There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.
answered 13 Jun '11, 22:05