How to show Disk Space in Pie Chart

[sunnyparmar]

I have my own PC for which I have to show the used disk space value in Pie chart on splunk.. I have something query like this where I have 2 counters. One is "Free Megabytes" and another is "% Free Space" but from where it takes the used disk space as from perfmon logs i am not able to locate used disk space value.

index=sc-perfmon sourcetype="Perfmon*" counter="Free Megabytes" OR "% Free Space" | stats count by counter

Thanks
Ankit

[fdi01 · Accepted solution]

you use this search index=sc-perfmon sourcetype="Perfmon*" source=Perfmon:FreeDiskSpace host=BWIN7136 Name="D:" | timechart eval(sum(TotalSpaceKB) / 1048576) as Total_Space, eval(sum(FreeSpaceKB) / 1048576) as Free_Space | eval consumed_space = Total_Space - Free_Space

you use the fields "TotalSpaceKB" and "" FreeSpaceKB "in your Requette but I do not think these fields are in your data. exchange them with the corresponding fields in your data as they are part of the data of Mr lukas.loder

try also like this:

index=sc-perfmon sourcetype="Perfmon*"|timechart sum(eval(counter="Free Megabytes" OR counter="% Free Space")) as free_megabit  sum(eval(counter!="Free Megabytes" OR counter!="% Free Space")) as used_space

[sunnyparmar]

Hey fdi,

Finally I have a query something like given below..

index=sc-perfmon sourcetype="Perfmon*" source="Perfmon:FreeDiskSpace" "instance=c" OR "instance=d" | eval TotalinGB = round(counter="Free Megabytes"/(1024*1024*1024),3) | eval FreeinGB=round(counter="Free Space"/(1024*1024*1024),3) | eval UsedinGB = TotalinGB - FreeinGB

but on running this query it is giving error (Error in 'eval' command: Typechecking failed. '/' only takes numbers. ) so could you please tell me where I am wrong?

Regards
Ankit

[sunnyparmar]

Hey fdi,

could you please tell me with this query how to show value in GB as right now it is showing in 4 or 5 digits value.

index=sc-perfmon sourcetype="Perfmon*" "instance=c" OR "instance=d" | timechart sum(eval(counter="Free Megabytes" OR counter="% Free Space")) as free_megabit sum(eval(counter!="Free Megabytes" OR counter!="% Free Space")) as used_space

Regards
Ankit

[sunnyparmar]

Hey fdi01,

You solved my problem.. I am so dumb..didn't notice this thing.. Right now it started showing the data. Thanks a lot for your valuable input.

Regards
Ankit

[lukas_loder]

Hi Anik

I was doing something like this:

index=test sourcetype=WinHostMon source=disk host=$field_server$ Name="D:" | timechart eval(sum(TotalSpaceKB) / 1048576) as Total_Space, eval(sum(FreeSpaceKB) / 1048576) as Free_Space | eval consumed_space = Total_Space - Free_Space

This one just displays the D-Disk but it works fine as a Graph. With this I get one Color "Total_Space", one "Free_Space" and one "consumed_space".

Regards

[sunnyparmar]

Hey,

Finally I have a query something like given below..

index=sc-perfmon sourcetype="Perfmon*" source="Perfmon:FreeDiskSpace" "instance=c" OR "instance=d" | eval TotalinGB = round(counter="Free Megabytes"/(1024*1024*1024),3) | eval FreeinGB=round(counter="Free Space"/(1024*1024*1024),3) | eval UsedinGB = TotalinGB - FreeinGB

but on running this query it is giving error (Error in 'eval' command: Typechecking failed. '/' only takes numbers. ) so could you please tell me where I am wrong?

Regards
Ankit

[sunnyparmar]

Hey.. sorry for replying late.. when i am running the manual query that is given below it is showing the output like this.. here i have one more doubt that is do I need to mention some parameter for GB in inputs.conf file in order to show the value in GB's in splunk. My inputs.conf file conf. is given below

[perfmon://FreeDiskSpace]
counters = Free Megabytes;% Free Space
instances = *
interval = 10
object = LogicalDisk
useEnglishOnly=true
disabled = 0
index = sc-perfmon

Query
index=sc-perfmon "instance=c" source="Perfmon:FreeDiskSpace"
Output
06/08/2015 18:23:09.542 +0500
collection=FreeDiskSpace
object=LogicalDisk
counter="% Free Space"
instance=C:
Value=21.288293830994441

Regards
Ankit

[lukas_loder]

Do you want the UsedSpace in Percent? Cauce you see there just the value in percent. And you nowhere see it in GB.

[sunnyparmar]

Hey,

I want to show the values in GB with this query as right now it is showing in 4 or 5 digits.

index=sc-perfmon sourcetype="Perfmon*" "instance=c" OR "instance=d" | timechart sum(eval(counter="Free Megabytes" OR counter="% Free Space")) as free_megabit sum(eval(counter!="Free Megabytes" OR counter!="% Free Space")) as used_space

Regards
Ankit

[sunnyparmar]

Hey,

however I able to run the query by editing some fields. I am updating the query below but still total space and free space columns showing nothing. Query is -

index=sc-perfmon sourcetype="Perfmon* " source="Perfmon:FreeDiskSpace" "instance=c" | timechart eval(sum(TotalSpaceKB) / 1048576) as Total_Space, eval(sum(FreeSpaceKB) / 1048576) as Free_Space | eval consumed_space = Total_Space - Free_Space

Please tell where I am wrong??

Regards
Ankit

[lukas_loder]

Can you please send me an example of the value of your TotalSpaceKB and FreeSpaceKB?

[sunnyparmar]

Hi Lukas,

Thanks for replying but My query is something like this but still it is not showing the result so could you please find out where I am doing wrong?

index=sc-perfmon sourcetype="Perfmon*" source=Perfmon:FreeDiskSpace host=BWIN7136 Name="D:" | timechart eval(sum(TotalSpaceKB) / 1048576) as Total_Space, eval(sum(FreeSpaceKB) / 1048576) as Free_Space | eval consumed_space = Total_Space - Free_Space

Regards
Ankit

[stephanefotso]

Hello! Your counter field does not include Free Space values. You must specify counter="% Free Space" in your search criteria.
Here you go!

index=sc-perfmon sourcetype="Perfmon*" (counter="Free Megabytes" OR counter="% Free Space" )| stats count by counter

Thanks

[sunnyparmar]

Hey Stephane,

Finally I have a query something like given below..

index=sc-perfmon sourcetype="Perfmon*" source="Perfmon:FreeDiskSpace" "instance=c" OR "instance=d" | eval TotalinGB = round(counter="Free Megabytes"/(1024*1024*1024),3) | eval FreeinGB=round(counter="Free Space"/(1024*1024*1024),3) | eval UsedinGB = TotalinGB - FreeinGB

but on running this query it is giving error (Error in 'eval' command: Typechecking failed. '/' only takes numbers. ) so could you please tell me where I am wrong?

Regards
Ankit

[sunnyparmar]

Hey both the counters have been showing (counter="Free Megabytes" and counter= "% Free Space" both in ) when i am searching manually as these are the parameters what I have defined in inputs.conf as you can see below

[perfmon://FreeDiskSpace]
counters = Free Megabytes;% Free Space
instances = *
interval = 10
object = LogicalDisk
useEnglishOnly=true
disabled = 0
index = sc-perfmon

With this I want to show the used disk space in GB with the below given query as right now it is coming in 4 or 5 digits so could you please help me with this?

index=sc-perfmon sourcetype="Perfmon*" "instance=c" OR "instance=d" | timechart sum(eval(counter="Free Megabytes" OR counter="% Free Space")) as free_megabit sum(eval(counter!="Free Megabytes" OR counter!="% Free Space")) as used_space

Regards
Ankit

[sunnyparmar]

Yes .. I have the counter field as shown below ..

06/08/2015 18:23:09.542 +0500
collection=FreeDiskSpace
object=LogicalDisk
counter="% Free Space"
instance=C:
Value=21.288293830994441

Regards
Ankit

[stephanefotso]

Please let me know again if you have events with the search bellow:

    index=sc-perfmon sourcetype="Perfmon*" counter!="Free Megabytes"  counter!= "% Free Space"

[sunnyparmar]

Hey stephan,

This is what when I am running query manually it is showing something like this.

index=sc-perfmon "instance=c" source="Perfmon:FreeDiskSpace"

06/08/2015 17:38:29.547 +0500
collection=FreeDiskSpace
object=LogicalDisk
counter="% Free Space"
instance=C:
Value=21.293176691178626

Regards
Ankit

[stephanefotso]

Please let me know if you have a field called counter showing at the field side bar when you just run the search index=sc-perfmon "instance=c" source="Perfmon:FreeDiskSpace counter=*

[sunnyparmar]

Hey.. now it is started showing the data on main screen but when I am going to click on (view events) under any parameter it didn't showing any data.

Regards
Ankit