0

I am trying to run a search against all hosts but I am having difficulty figuring out the right approach. A simplified version of what I am looking for is:

index=os sourcetype=df host=system323 mount=/var | streamstats range(storage_used) as storage_growth window=2

But ultimately I want it to search all mount points on all hosts and then send that to a chart or a report.

I tried a few different approaches but none of them gave me the expected results. I felt like I was on the right path with sub-searches, because it felt like the equivalent of a for loop but it did not yield the expected results

index=os sourcetype=df [search index=os sourcetype=df [search index=os sourcetype=df earliest=-1d@d latest=now() | stats values(host) AS host] earliest=-1d@d latest=now() | stats values(mount) AS mount] | streamstats range(storage_used) as storage_growth window=2

How can I take my first search an build a report that will include all hosts and mount points?

xdfil
  • 291
  • 1
  • 14

1 Answers1

0

Much simpler than sub-searches. Just use a by clause in your streamstats:

index=os sourcetype=df 
| eval mountpoint=host+":"+mount 
| streamstats range(storage_used) as storage_growth by mountpoint window=2 
| table _time,mountpoint,storage_growth
Adrian Hall
  • 7,990
  • 1
  • 18
  • 26