Trying to create a report for avg CPU usage and failing.
current search is
splunk_server=red counter="% Processor Time" | eval IdleCpu=(100-Value)|table host avg(IdleCpu)
I just want to get the average cpu usage over a given period of time. I get the data but things are not being averaged out.
Once you have the calculated the value you want for CPU, in this case idle CPU you just pipe it to time chart and use avg() by host. Is this what you are looking for?
... | timechart span=1m avg(idleCPU) by host
Just use the tail command. You could also sort it in ascending order to see those with greatest idle time at the top.
... | tail 10
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/tail
This is what I came up with so far.
splunk_server=red counter="% Processor Time" | eval IdleCpu=(100-Value) | eval IdleCpu=round(IdleCpu,2)|chart avg(IdleCpu) as IdleCpu by host
Yours gives me no results found. Now if I could just get the bottom 10 to 15 hosts that have the smallest idle times. | top host gives me the systems with the greatest idle time and I want the system with the least idle time.