I want to show a graph for min free disk space for the hosts. But I want to show only first 10 hosts on graph having free disk space as lowest.
My basic query is:
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f
How to improve this query to get only first 10 hosts having lowest free disk space?
Hi,
i would say this will solve you problem :
http://www.splunk.com/base/Documentation/latest/SearchReference/Head
or in your example :
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f | head 10
well it depends on your query, head will return you the first 10 rows of your search so you either sort it before or using the top command http://www.splunk.com/base/Documentation/latest/SearchReference/top , which is probably the easier way 🙂 sorry didn't think on that before
Will it give me the top users having lowest free disk space, or it will give me first 10 results. I want those 10 users having lowest free disk space.