Can I chart the available disk space?

[wishlist]

Hi Guys

I am trying to make a chart of disk space used over time but the query I have built (below) simply returns a result of '1' indicating that a value is present, how can I extract the value of 'Value' to use in a chart?

Here is an example of the data:

06/14/2011 12:30:59.466

collection="Free Disk Space"

object=LogicalDisk

counter="Free Megabytes"

instance=E:

Value=134341

host=ROMERO Options| sourcetype=Perfmon:Free Disk Space

Using this query:

host="romero" source="Perfmon:Free Disk Space" | timechart values(Value) as FreeSpace

I get a result that looks like this:

6/8/11 12:00:00.000 AM

134679
134681
134687
134691

6/9/11 12:00:00.000 AM

134529
134530
134531
134532
... etc

When I chart this result, each Value, is shown on the chart with a value of '1' so each time-frame simply shows the number of values in that time period, which is the same every time period obviously, rather than using the actual values to draw the chart to show how much space is being used.

Is it possible extract these values for use in a chart?

Thanks 🙂

[Ayn]

Sure. First, some explanation for how timechart behaves: timechart needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:

host="romero" source="Perfmon:Free Disk Space" | timechart span=1m avg(Value) as FreeSpace

Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.

host="romero" source="Perfmon:Free Disk Space" | table _time Values

[dwaddle]

If this solved your issue, please click the checkbox next to the answer to "accept" it.

[wishlist]

Thanks Ayn 🙂

This:

host="romero" source="Perfmon:Free Disk Space" | timechart span=30m avg(Value) as FreeSpace

Worked a treat 😄

D

nb. I changed the timespan, as the disk space is only read every 30 minutes.