Splunk Search

Timechart cpuload different results for different time intervals

1234testtest
Path Finder

Hi - I want to display the cpu, mem statistics (avg, min, max) for a specified duration - last 4 hours, 24 hours etc.,
I am using the following search. The problem is that I'm getting different values for the same time - like for eg 6AM in the morning for both these results shows different values.
Any idea what needs correction

source=WMI:CPUTime host=* | eval CPULoad = PercentProcessorTime | timechart avg(CPULoad) min(CPULoad) max(CPULoad) minspan=10m by host | join _time [search source=WMI:memory host=* | timechart avg(AvailableMBytes) min(AvailableMBytes) max(AvailableMBytes) minspan=10m by host]

0 Karma

dart
Splunk Employee
Splunk Employee

what frequency are you collecting the data on?
Why not just do one search, like so :
source=WMI:CPUTime OR source=WMI:memory | rename PercentProcessorTime as CPULoad | timechart avg(CPULoad) min(CPULoad) max(CPULoad) avg(AvailableMBytes) min(AvailableMBytes) max(AvailableMBytes) by host
When you search over different timeranges, your time windows will be different sizes, you've just specified a minimum time span - Splunk can pick a larger time span than you've specified.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...