Refine your search:

I'm trying to write a search that will compare values from different data inputs and return the highest value to use as a rangemap. The values are cpu usage, memory usage, disk read percentage and write percentage. CPU, memory and Disk IO come from different data inputs. When I use the search below, it build the table I want, but the different inputs show up on different rows, so the compare doesn't function properly. My search is:

index="rws_wmi" ComputerName=csiadrws01 | eval cpu=PercentProcessorTime | eval mem=PercentCommittedBytesInUse | eval read=PercentDiskReadTime | eval write=PercentDiskWriteTime | eval health=max(cpu, mem, read, write) | rangemap field=health low=0-50 elevated=51-80 severe=81-100 | table cpu mem read write health range

Any advice would be great.

asked 20 Dec '11, 08:09

achudnoff's gravatar image

achudnoff
206
accept rate: 0%


One Answer:

Try this instead

index="rws_wmi" ComputerName=csiadrws01 |
stats max(PercentProcessorTime) as cpu max(PercentCommittedBytesInUse) as mem
        max(PercentDiskReadTime) as read max(PercentDiskWriteTime) as write |
eval health=max(cpu, mem, read, write) |
rangemap field=health low=0-50 elevated=51-80 severe=81-100

I don't really understand the health field, but I still think this will work. If it doesn't, try running the command without the eval and rangemap, just to see what you get back. Note that the spacing is just for readability.

link

answered 21 Dec '11, 13:59

lguinn's gravatar image

lguinn ♦
21.0k91228
accept rate: 30%

This looks like exactly what I wanted. Thanks so much!

(21 Dec '11, 14:56) achudnoff
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×321
×11

Asked: 20 Dec '11, 08:09

Seen: 1,210 times

Last updated: 21 Dec '11, 14:56

Copyright © 2005-2014 Splunk Inc. All rights reserved.