Monitoring Splunk

How to calculate the free disk capacity in MB?

jip31
Motivator

hello

I use this code `in order to calculate the free disk space but I also need to know the capacity disk in MB. I am unable to find a counter for this. The value has to be displayed in the "x" variable. Could you help me, please?

| join type=outer host [search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" | eval Disk_Available_Space =round(Value, 0). " MBytes /x" ]
0 Karma
1 Solution

FrankVl
Ultra Champion

Doesn't perfmon also have a % Free Space counter that you can use for this?

You can use the combination of those 2 counters to calculate the total space, for example (tune this to exactly what you need)

search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" OR counter="% Free Space"
| eval perc_free = if(counter="% Free Space",Value,null)
| eval mb_free = if(counter="Free Megabytes",Value,null)
| stats latest(mb_free) as mb_free latest(perc_free) as perc_free by instance,host
| eval total_space = mb_free / (perc_free) * 100

View solution in original post

0 Karma

FrankVl
Ultra Champion

Doesn't perfmon also have a % Free Space counter that you can use for this?

You can use the combination of those 2 counters to calculate the total space, for example (tune this to exactly what you need)

search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" OR counter="% Free Space"
| eval perc_free = if(counter="% Free Space",Value,null)
| eval mb_free = if(counter="Free Megabytes",Value,null)
| stats latest(mb_free) as mb_free latest(perc_free) as perc_free by instance,host
| eval total_space = mb_free / (perc_free) * 100
0 Karma

jip31
Motivator

sorry but i dont succeed
in my field i Something like this :`mb_free "MB" / total_space "MB"

0 Karma

FrankVl
Ultra Champion

Can you please stop posting comments as answers. I can convert them to comments, but it is easier if you post them as a comment right away 🙂

Given that the data is in the fields mb_free and total_space. This should work to print it as you want:

| eval Disk_Available_Space = round(mb_free,0)."MB / ".round(total_space,0)."MB"
0 Karma

jip31
Motivator

yes but i done this and it dont works

 eval Disk_Available_Space =round(Value, 0). " MBytes /.total_space" | table Disk_Available_Space
0 Karma

FrankVl
Ultra Champion

You need to take that part outside of the quotes.

0 Karma

jip31
Motivator

Perfect thanks
last question i want mb free band total space in a same field seperated by \

0 Karma

FrankVl
Ultra Champion

You already pretty much had the code for that right? Just use .total_space to concatenate the total_space field to the string you already generated.

0 Karma

jip31
Motivator

% Free Space dont give me directly the total space...

0 Karma

FrankVl
Ultra Champion

See my updated answer for how you can combine the 2 counters to calculate that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...