Answers for "Can I chart the available disk space?"
https://answers.splunk.com/answers/26190/can-i-chart-the-available-disk-space.html
The latest answers for the question "Can I chart the available disk space?"Answer by Ayn
https://answers.splunk.com/answering/26191/view.html
Sure. First, some explanation for how `timechart` behaves: `timechart` needs some kind of statistical function that returns a unique value for the timespan it's operating on. If you don't define the timespan yourself it will be set dynamically depending on what timerange the whole search spans, but let's take an example where the timespan is 1 minute and that somewhere in your log you have 3 of these events occurring within 1 minute. Splunk needs to know how to give you ONE value for "Value", even though there are 3 values of each. You can tell Splunk to just give you an average from the 3 events using the stats function avg:
host="romero" source="Perfmon:Free Disk Space" | timechart span=1m avg(Value) as FreeSpace
Or, if you only want the values from the first of the events within the time period, use first instead of avg. Want the sum? Use sum. And so on. More information on statistical functions is available here: http://www.splunk.com/base/Documentation/latest/SearchReference/Stats
There's also a second way to do this, which is to produce a table containing timestamps and values yourself and then feed them into the chart.
host="romero" source="Perfmon:Free Disk Space" | table _time ValuesTue, 14 Jun 2011 05:05:34 GMTAyn