| makeresults | eval data="%{\"stats\": {\"value\": 44.85097033572893, \"key\": \"ifs.percent.used\", \"devid\": 0, \"error_code\": null, \"time\": 1489611549, \"error\": null}, \"timestamp\": \"2017-03-15 20:59:10\", \"node\": \"10.192.14.118\", \"namespace\": \"statistics\"}
%{\"stats\": {\"value\": 526733856178176, \"key\": \"ifs.bytes.free\", \"devid\": 0, \"error_code\": null, \"time\": 1489611549, \"error\": null}, \"timestamp\": \"2017-03-15 20:59:09\", \"node\": \"10.192.14.118\", \"namespace\": \"statistics\"}
%{\"stats\": {\"value\": 518188251906048, \"key\": \"ifs.bytes.avail\", \"devid\": 0, \"error_code\": null, \"time\": 1489611549, \"error\": null}, \"timestamp\": \"2017-03-15 20:59:09\", \"node\": \"10.192.14.118\", \"namespace\": \"statistics\"}" | rex max_match=9999 field=data "(?<json>[^%]+)" | mvexpand json | table json | spath input=json | rename stats.* AS *| eval used=if(key = "ifs.percent.used", value, null()) | eval free=if(key = "ifs.bytes.free", value, null()) | eval avail=if(key = "ifs.bytes.avail", value, null()) | stats last(avail) as avail last(free) as free last(used) as used by node
... View more