true `ontap-index` sourcetype=ontap:system source="system-get-version" | fields host | dedup host | sort host -4h now host host true `ontap-index` sourcetype=ontap:perf source=AggrPerfHandler host="$host$" | fields instance_name | dedup instance_name | rename instance_name AS aggregate | sort aggregate -4h now aggregate aggregate Last 60 minutes
`ontap-index` sourcetype="ontap:aggr" (source="aggr-list-info" name="$name$") OR (source="aggr-get-iter" aggregate-name="$name$" ) host="$host$" | `CoalesceAggrFields` | dedup name, host | eval "gb-total"=`BytesToGigaBytes(sz_total)` | eval "gb-free"=`BytesToGigaBytes(sz_free)` | table name, host, volume-count, size-percentage-used, "gb-total", "gb-free" | rename name AS "Aggregate", host AS "Host", volume-count AS "Volumes", size-percentage-used AS "Used (%)", gb-total AS "Total (GB)", gb-free as "Free (GB)" -24h@h now Aggregate Detail
 `ontap-index` sourcetype="ontap:volume" host="$host$" (source="volume-get-iter" OR source="volume-list-info-iter-start") | `CoalesceVolumeFields` | rename name as volume | search "containing-aggregate"="$name$" | dedup "containing-aggregate", host, volume | rename "containing-aggregate" as aggregate | sort aggregate, volume | table volume, host, aggregate | rename volume AS "Volume", host AS "Host", aggregate AS "Aggregate" -24h@h now Associated Volumes
[^:]+):(?.*?)$" | eval instance_name=if(isnull(instance_name),name,instance_name) | rename disk-name AS disk_name disk-raid-info.disk-aggregate-info.aggregate-name AS dri_aggr_name serial-number AS serial_number disk-type AS disk_type disk-inventory-info.serial-number AS dii_sn disk-inventory-info.disk-type AS dii_dt disk-ownership-info.owner-node-name as dii_hnn | eval name=if(isnull(name),disk_name,name) | eval aggregate=if(isnull(aggregate),dri_aggr_name,aggregate) | eval disk-type=if(isnull(disk_type),dii_dt,disk_type) | eval serial-number=if(isnull(serial_number),dii_sn,serial_number) | eval node-name=if(isnull(node_name),dii_hnn,node_name) | dedup name | rename name as disk | table host, aggregate, disk, disk-type, serial-number, instance_name, node-name | rename host AS "Host", aggregate AS "Aggregate", disk AS "Disk", disk-type AS "Type", serial-number AS "Serial Number", instance_name AS "Name", node-name AS "Node" ]]> -24h@h now Associated Disks
`ontap-index` sourcetype="ontap:perf" source=AggrPerfHandler host="$host$" instance_name="$name$" | timechart first(cp_reads_rate) as cp_reads_rate first(total_transfers_rate) as total_transfers_rate first(user_reads_rate) as user_reads_rate first(user_writes_rate) as user_writes_rate by instance_name Aggregate Transfer Rates (OPS/sec)