Splunk Search

I want to identify the top 10 cpu averages over the past 15 minutes and then "timechart span=1m" that average cpu over that same 15 minutes

lycollicott
Motivator

So, I use this query:

index=perfmon object=Processor host=* counter="% Processor Time" | stats avg(Value) as 15minavg by host | sort 5 - 15minavg

to produce a dashboard panel like this:

host    15minavg
server08    82.822502
server11    56.993420
server04    56.809193
server19    52.914549
server12    52.114838

Now, I would like to rework that panel to be a horizon visualization of timechart span=1m avg(Value) by host for only those servers.
It's Friday afternoon and I've spent the last 3 hours trying top, where, append, join and I'm no further ahead than when I began.

Any suggestions?

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

What about using a subsearch like this:

  index=perfmon object=Processor counter="% Processor Time" earliest=-15m [
      | search index=perfmon object=Processor host=* counter="% Processor Time" earliest=-15m 
      | stats avg(Value) as 15minavg by host 
      | sort 5 - 15minavg 
      | table host 
  ] | timechart span=1m avg(Value) by host

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

index=perfmon object=Processor host=* counter="% Processor Time" [search index=perfmon object=Processor host=* counter="% Processor Time" | stats avg(Value) as 15minavg by host | sort 5 - 15minavg | table host ] | timechart span=1m avg(Value)  by host 

javiergn
SplunkTrust
SplunkTrust

What about using a subsearch like this:

  index=perfmon object=Processor counter="% Processor Time" earliest=-15m [
      | search index=perfmon object=Processor host=* counter="% Processor Time" earliest=-15m 
      | stats avg(Value) as 15minavg by host 
      | sort 5 - 15minavg 
      | table host 
  ] | timechart span=1m avg(Value) by host
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...