Show mount points instead of entity names

[sinisa_zubic]

Hi team!!

Is there any way to show the names of the mount points instead of entity names in a dql query like this?

timeseries from:now()-2h, to:now(),avg(dt.host.disk.used),by:{host.name,dt.entity.disk},interval:1m 
| filter host.name == "demodev-master"

Best,
Sini

[stefan_eggersto · Accepted solution]

Hi Sini,

you just need to add a lookup to disk entities, e.g.

timeseries from:now()-2h, to:now(),avg(dt.host.disk.used),by:{host.name,dt.entity.disk},interval:1m 
| filter host.name == "demodev-master"
| lookup sourceField:dt.entity.disk, lookupField:id, prefix:"disk.", [ fetch dt.entity.disk | fields id, mountPoint = entity.name ]