Splunk search for Windows Free Disk Space by Drive
Copy
(index=windows OR index=perfmon OR index=os) sourcetype=perfmonMK:LogicalDisk instance!=_Total instance!=Harddisk* | eval FreePct-Other=case( match (instance, "C:"), null(), match(instance,"D:"), null(),true(),storage_free_percent), FreeMB-Other=case( match (instance, "C:"), null(), match(instance,"D:"), null(), true(),Free_Megabytes), FreePct-{instance}=storage_free_percent,FreeMB-{instance}=Free_Megabytes
This Splunk search will provide the percent of free disk space on Windows hosts. This search depends on the relevant hosts reporting perfmon data on LogicalDisk. This particular search uses the perfmonMK sourcetype that comes with the Add on For Windows.
0 comments
[0]
[0]
[0]
[0]
Sign in or Register to submit a comment