Visual chart for how much free disk space is available?

[shakeel253]

when i run the query in splunk search [ host=tableau sourcetype="Perfmon:Free Disk Space" ]

I get the below mentioned results

9/7/17
3:57:43.000 PM

09/07/2017 11:57:43.647 -0400
collection="Free Disk Space"
object=LogicalDisk
counter="% Free Space"
instance=_Total
Value=80.07256674174579

Can someone help me with a query that would actually give visual chart for how much free Disk space is available?

[niketn]

Reattaching image as the same got removed

[niketn]

@shakeel253, What is the frequency of your Performance Counter data collection?
Lets say if it is 15 min. I would run a query like the following for looking at historical %Free Space:

host=tableau sourcetype="Perfmon:Free Disk Space" instance="_Total" object="LogicalDisk" counter="% Free Space" 
| timechart span=15m max(Value) as PercentFree

PS: by host is not required for your timechart since you have only one host selected in base search.

I have included instance="_Total" however, you can choose as per your need. It was missing in your original search (if you Logical Disc has several Partitions you will have to create individual panels for your partitions or add by instance condition to your transforming command to generate table and if required split through newly introduced Trellis Layout (in Splunk 6.6).

---

For displaying in Gauge (Radial or Filler) as your second question, you can try the following:

host=tableau sourcetype="Perfmon:Free Disk Space" instance="_Total" object="LogicalDisk" counter="% Free Space" 
| head 1
| eval Value=round(Value,1)
| table Value

Then set the color ranges based on SLA from Edit Format in UI or directly via Simple XML Gauge configuration.
Following set first range as Red then Yellow and finally Green

    <option name="charting.gaugeColors">["0xd13b3b","0xFFE800","0x84E900"]</option>

---

If you want to display actual Logical Disc Free Space and Total Space, you will have to try the following approach:
Capture two Performance Counters for object="LogicalDisk":
1) counter="% Free Space" (this you already have)
2) counter="Free Megabytes": If you are not collecting this as present you can start collecting this counter as well.

You can get Total Megabytes as (Free Megabytes/% Free Space)*100

host=tableau sourcetype="Perfmon:Free Disk Space" instance="_Total" object="LogicalDisk" counter="% Free Space" OR  counter="Free Megabytes"
|  stats last(Value) as Value by counter
|  transpose header_field=counter column_name=counter
|  rename "Free Megabytes" as x
|  eval y4=(x/'% Free Space')*100
|  fields - counter "% Free Space"
|  eval y2=(y4/100)*10
|  eval y3=(y4/100)*30
|  eval y1=0

PS: x is Free Megabytes, y1 is 0 MB (0%), y2 is 10% of Total Free MBs, y3 is 30% of Total Free MBs and y4 is 100% (Total MBs).
So, 0-10% is RED, 10-30% is Yellow and 30-100% is Green as per example SLA.

Following is the sample Simple XML code as per screenshot:

<dashboard>
  <label>Radial Gauge Dynamic Value Color</label>
  <row>
    <panel>
      <title>Logical Disc Space - Free %</title>
      <chart>
        <search>
          <query>host=tableau sourcetype="Perfmon:Free Disk Space" instance="_Total" object="LogicalDisk" counter="% Free Space" 
    | head 1
    | eval Value=round(Value,1)
    | table Value</query>
          <earliest>-10m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.rangeValues">[0,10,30,100]</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">["0xd13b3b","0xFFE800","0x84E900"]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
        <option name="charting.legend.placement">right</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
    <panel>
      <title>Logical Disc Space - Free MBs</title>
      <chart>
        <search>
          <query>host=tableau sourcetype="Perfmon:Free Disk Space" instance="_Total" object="LogicalDisk" counter="% Free Space" OR  counter="Free Megabytes"
|  stats last(Value) as Value by counter
|  transpose header_field=counter column_name=counter
|  rename "Free Megabytes" as x
|  eval y4=(x/'% Free Space')*100
|  fields - counter "% Free Space"
|  eval y2=(y4/100)*10
|  eval y3=(y4/100)*30
|  eval y1=0</query>
          <earliest>-10m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">["0xd13b3b","0xFFE800","0x84E900"]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
        <option name="charting.legend.placement">right</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>

[shakeel253]

Thanks a lot for your assistance Niketnilay

[niketn]

@shakeel253, dont forget to up vote the Answer, in case you find this helpful for your use case.

[shakeel253]

Thankyou ssievert for a prompt response, i was able to get some results. Is there a way, where it can show me free diskspace on a guage showing used / available free space

[s2_splunk]

I recommend you download the dashboard examples app, which gives you a lot of information on the various visualizations available in Splunk.
To show available space, you would need a metric that gives you the amount of total disk space. I am not sure whether perfmon has such a counter.

[s2_splunk · Accepted solution]

Not sure what interval you want this for, but try this: host=tableau sourcetype="Perfmon:Free Disk Space" counter="% Free Space" | timechart avg(Value) as PercentFree by host
If you need a different grouping than host, just change the by-clause.
Then pick the visualization that best meets your needs.