Splunk search for Disk free space over time on Linux machine
Copy
sourcetype=df PercentFreeSpace=* mount="/" | timechart latest(PercentFreeSpace) as "% Free Space" by host
This search will provide a timechart of disk free space per linux host that is reporting a sourcetype of df. This sourcetype can be obtained using the Add on for Unix/Linux.