Splunk Search

How to use key names in legend values?

bryanbrady
Engager

I have the following search:

host=* sourcetype=cpu
| multikv fields, pctUser, pctNice, pctSystem, pctIowait, pctIdle
| eval total = 100-pctIdle
| timechart bins=1000
avg(pctUser), avg(pctSystem), avg(pctIowait), avg(total),
max(pctUser), max(pctSystem), max(pctIowait) max(total)
by host

The legend in the resulting timechart has names with the form:

avg(pctUser) : HostName1
avg(pctUser) : HostName2
avg(pctSystem) : HostName1
avg(pctSystem) : HostName2
...

I want to sort the legend values by host, so that all of legend entries for a particular host are sequential, and I want the hostname first:

HostName1 : avg(pctUser)
HostName1 : avg(pctSystem)
HostName2 : avg(pctUser)
HostName2 : avg(pctSystem)

I know how to do this when the data I need is a value. The macro from the Unix TA add on is a good example of this:

host=$host$ sourcetype=df
| strcat host '@' Filesystem Host_FileSystem
| timechart avg(UsePct) by Host_FileSystem
| rename avg(UsePct) as %Used

I haven't been able to figure out how to use the key, instead of the value, when creating legend entries. I tried to rename the fields, i.e., :
avg(pctUser) as host+"something"
but it's not being evaluated, and shows up as "host+avg(pctUser)"

Any ideas?

Tags (3)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this workaround.

host=* sourcetype=cpu | multikv fields, pctUser, pctNice, pctSystem, pctIowait, pctIdle 
| eval total = 100-pctIdle | bucket bins=1000 _time 
| stats  avg(pctUser), avg(pctSystem), avg(pctIowait), avg(total), max(pctUser), max(pctSystem), max(pctIowait) max(total) by _time, host | eval temp=_time."#".host | untable temp metric value
| rex field=temp "(?<_time>.*)#(?<host>.*)" | eval host=host.":".metric | xyseries _time host value

bryanbrady
Engager

This is exactly what I was looking for. Thanks! somesoni2

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...