help on eval

[jip31]

hello
In "eval TotalSpace" I need to multiply "Percfree_space" with "FreeSpace" and to add the FreeSpace total to the result and to display
the result of "FreeSpace" and "TotalSpace" in "eval Disk"
I done this but it doesnt works
Could you help me please??

| eval MBfree_space = if(counter="Free Megabytes",Value,null) 

| eval Percfree_space = if(counter="% Free Space",Value,null)  

| eval FreeSpace = round(MBfree_space/1024,2)." MB / "

| eval TotalSpace = round((100-Percfree_space)*(FreeSpace)+(FreeSpace),2))." MB"

| eval Disk = FreeSpace "/" TotalSpace

[woodcock]

It is likely that the problem is that each metric is in a different event. If so, the separate events must be merged before the fields/values can be used together. In any case, until you show us EXACTLY what each event is, it is unlikely that anyone will be able to help.

[DalJeanis]

The problem appears to be that you have two different kinds of records, each a different counter, and so one of the numbers on each record will always be null. Multiplying anything times null will always be null. if you use fillnull, you will multiply by zero and get zero.

I'm going to guess that these are Perfmon metric records on Windows. I guessed that by doing a google search for the key words and field names you are looking for... site:answers.splunk.com free megabytes counter value If you just search for what you are trying to do, you will find multiple examples.

This one is somewhat similar to your issue, and has an excellent answer by @cusello, and other quick answers by @woodcock and @somesoni2, two of our heavy hitters.

https://answers.splunk.com/answers/512937/how-to-combine-2-searches-to-get-show-values-and-p.html

Here's another...

https://answers.splunk.com/answers/454999/how-to-develop-a-search-to-find-free-disk-space-us.html

And here's one I just have to include because the accepted answer is code written by awesome Splunk guy @jkat54, and it is code which clearly embarrassed him to post, so I just have to call everybody's attention to it...

https://answers.splunk.com/answers/439855/how-to-calculate-total-disk-size-when-using-freedi.html

There's another version in a comment underneath his which refactors jkat's code from a join to stats, which is the preferred method, but if either one meets your use case, use it.

[493669]

Try this:

 | eval MBfree_space = if(counter="Free Megabytes",Value,null) 
 | eval Percfree_space = if(counter="% Free Space",Value,null)  
 | eval FreeSpace = round(MBfree_space/1024,2)
 |fillnull
 | eval TotalSpace = round(((100-Percfree_space)*FreeSpace)+FreeSpace,2)
 | eval Disk = FreeSpace."MB". "/". TotalSpace."MB"

[jip31]

Nobody for helping me please?
with this i have no results
| eval MBfree_space = if(counter="Free Megabytes",Value,null)
| eval Percfree_space = if(counter="% Free Space",Value,null)

| eval FreeSpace = round(MBfree_space/1024,2)
| eval TotalSpace = round(((100-Percfree_space)*FreeSpace)+FreeSpace,2)
| eval Disk = FreeSpace."MB". "/". TotalSpace."MB"
| stats latest(Disk) as Disk by host

[Shan]

@jip31,

Kindly Provide sample data as displayed by 493669.
So someone can help you ..
Without sample data and your expected result . how can someone help you 🙂 ..

Thanks

[jip31]

hello
the entire
index="perfmon" sourcetype="perfmon:logicaldisk" instance=c: counter="Free Megabytes" OR counter="% Free Space"| eval MBfree_space = if(counter="Free Megabytes",Value,null)
| eval Percfree_space = if(counter="% Free Space",Value,null)

| eval FreeSpace = round(MBfree_space/1024,2)
| eval TotalSpace = round(((100-Percfree_space)*FreeSpace)+FreeSpace,2)
| eval Disk = FreeSpace."MB". "/". TotalSpace."MB"| stats latest(Disk) as Disk

I need result with this format : 0.00MB/0.00MB
First the free space in MB and after the toatl space in MB
thanks a lot

[jip31]

it doesnt works
it calculate nothing because i have 0MB/0.00MB (also in other columns)
when i delete |fillnull i have nothing

[493669]

thats why I asked to share sample values of fields like counter value and expected result of TotalSpace Disk
like below-

counter                  Value   FreeSpace     TotalSpace               Disk 
Free Megabytes          23          0.02               2.02              0.02MB/2.02MB
% Free Space               30          0                 0.00              0MB/0.00MB

[493669]

can you provide some sample having value of field names counter ,value, etc. and expected result

[poete]

Hello @jip31,

what are you trying to do with this line : | eval Disk = FreeSpace "/" TotalSpace

It does not concatenate and does not perform an operation.

Did you not mean | eval Disk = FreeSpace ."/". TotalSpace ?

[jip31]

I dont understand your questions
Free Megabytes give the amount of free disk space in megabytes
% Free Space give the amount of free disk space in %
So in eval disk I need to display for example 300 MB / 400 MB