Splunk Search

All Disk Drives in WIndows, One Chart, From Perfmon Data

aferone
Builder

I'd like to have one column chart showing the percentage of drive space taken on each of the drives in the screenshot. I wouldn't want "_total", but I would want the other 3.

How would I accomplish this?

Thanks!

alt text

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

source="Perform:FOO" instance!="_Total" | chart latest(Value) by instance

View solution in original post

0 Karma

aferone
Builder

This s what I mean...

alt text

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

source="Perform:FOO" instance!="_Total" | chart latest(Value) by instance
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I see. In that case, go back to my original answer (minus the typo):

source="Perfmon:FOO" instance!="_Total" | chart latest(Value) by instance
0 Karma

aferone
Builder

Oh, yeah. What I mean, however, is I want to be able to only see one instance of the SET of drives. 3 bars total in this case, for C:, D:, and E:.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you only want to see "C:" for example you can add instance="C:" to the search query.

0 Karma

aferone
Builder

Not sure I understand. Can you clarify?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you want only one instance in the result you could add a filter by instance to the initial search.

0 Karma

aferone
Builder

That does work, but now I get a chart for every instance of the log, let's say for the past 24 hours. How do I force it to only show one "set" of numbers?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...