The following Splunk query will return results for all hosts reporting in Perfmon data on available disk space per assigned drive letter (NOTE you must make the change to include free diskspace per partition in your inputs.conf file) Query: sourcetype=”Perfmon:Free Disk Space” counter=”Free Megabytes” (instance!=”HarddiskVolume*”) (instance!=_Total) |eval FreeSpace=(Value/1024)| eval GB=tostring(FreeSpace,”commas”) | table host instance GB […]
Available Disk Space on a Windows Box
This splunk query will return available disk space in Gigabytes. sourcetype=”Perfmon:Free Disk Space” | bucket _time span=1d | eval gigabytes=(Value/1024) | stats avg(gigabytes) by _time
