The following Splunk query will return results for all hosts reporting in Perfmon data on available disk space per assigned drive letter (NOTE you must make the change to include free diskspace per partition in your inputs.conf file) Query: sourcetype=”Perfmon:Free Disk Space” counter=”Free Megabytes” (instance!=”HarddiskVolume*”) (instance!=_Total) |eval FreeSpace=(Value/1024)| eval GB=tostring(FreeSpace,”commas”) | table host instance GB […]
Low Disk Space Alert for Windows Servers
eventtype=hostmon_windows Type=Disk host=”*” FileSystem=”*” DriveType=”*” | dedup host, Name | eval FreeSpacePct=round(FreeSpaceKB/TotalSpaceKB*100) | eval TotalSpaceGB=round(TotalSpaceKB/1024/1024) | eval FreeSpaceGB=round(FreeSpaceKB/1024/1024) | search FreeSpacePct<10 TotalSpaceGB=”*” | dedup host, Name, DriveType, TotalSpaceGB, FreeSpaceGB, FreeSpacePct | table host, Name, DriveType, TotalSpaceGB, FreeSpaceGB, FreeSpacePct | sort FreeSpacePct
Available Disk Space on a Windows Box
This splunk query will return available disk space in Gigabytes. sourcetype=”Perfmon:Free Disk Space” | bucket _time span=1d | eval gigabytes=(Value/1024) | stats avg(gigabytes) by _time
