You could win up to $50,000 building Splunk apps in the Splunk>Apptitude contest. Learn more »
I'm trying to write a search that will compare values from different data inputs and return the highest value to use as a rangemap. The values are cpu usage, memory usage, disk read percentage and write percentage. CPU, memory and Disk IO come from different data inputs. When I use the search below, it build the table I want, but the different inputs show up on different rows, so the compare doesn't function properly. My search is:
index="rws_wmi" ComputerName=csiadrws01 |
eval cpu=PercentProcessorTime |
eval mem=PercentCommittedBytesInUse |
eval read=PercentDiskReadTime |
eval write=PercentDiskWriteTime |
eval health=max(cpu, mem, read, write) |
rangemap field=health low=0-50 elevated=51-80 severe=81-100 |
table cpu mem read write health range
Any advice would be great.
Try this instead
index="rws_wmi" ComputerName=csiadrws01 | stats max(PercentProcessorTime) as cpu max(PercentCommittedBytesInUse) as mem max(PercentDiskReadTime) as read max(PercentDiskWriteTime) as write | eval health=max(cpu, mem, read, write) | rangemap field=health low=0-50 elevated=51-80 severe=81-100
I don't really understand the health field, but I still think this will work. If it doesn't, try running the command without the eval and rangemap, just to see what you get back. Note that the spacing is just for readability.
listing events directly from a table 1 Answer