Dashboards & Visualizations

Why does my single panel show the incorrect amount of total disk space available?

vikas_gopal
Builder

Hi Experts,

I am using below to show total available disk in a single panel

<single>
        <search>
          <query>index=abc source=disk host=$host$ earliest=-10m@m | eval total = (TotalSpaceKB/(1024*1024))| stats avg(total)|rename avg(total) AS total</query>
        </search>
        <option name="height">30</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="underLabel">Total Disk in GB</option>
        <option name="showSparkline">0</option>
        <option name="showTrendIndicator">0</option>
      </single>

I can see result in the panel it shows 250 GB, now when I actually check total disk space on that machine it is 237 GB. Not sure why Splunk shows 13 GB extra. This machine only has one C drive. To collect disc data I am using

[WinHostMon://Disk]
interval = 600
disabled = 0
type = Disk
index = abc

Can anyone suggest what i am doing wrong here?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi vikas_gopal,
probably it's wrong your calculation of GB:

| eval total = TotalSpaceKB/1000000

you should use

| eval total = TotalSpaceKB/1024/1024

In fact:
250000000/1024/1024=238.4 GB
Bye.
Giuseppe

View solution in original post

0 Karma

niketn
Legend

Since you are getting performance counter for your disc utilization, should n't you always be trying to read only the single latest event? Assuming your inbound data arrives every 10 minutes.

index=abc source=disk host=$host$ earliest=-10m@m | head 1 | eval totalGB = round(TotalSpaceKB/(1024*1024),0)| stats values(totalGB)  as totalGB
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi vikas_gopal,
probably it's wrong your calculation of GB:

| eval total = TotalSpaceKB/1000000

you should use

| eval total = TotalSpaceKB/1024/1024

In fact:
250000000/1024/1024=238.4 GB
Bye.
Giuseppe

0 Karma

vikas_gopal
Builder

Thanks for correcting my Stupidity .

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@vikas_gopal - Did cusello's answer help solve your question? If so, please don't forget to click "Accept" below his answer to resolve this post. Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...