Splunk Search

How to use timechart and streamstats

hartfoml
Motivator

I have a search that will show me the top 3 processes like this

host=foo sourcetype=top | timechart span=1m sum(pctCPU) BY COMMAND limit=3 useother=f

I want to add the total line to the top three to combine them into one total CPU line.

I tried this but it did not work host=foo sourcetype=top | timechart span=1m sum(pctCPU) BY COMMAND limit=3 useother=f | streamstats sum(pctCPU) as TOTAL

Any help would be appreciated

0 Karma

somesoni2
SplunkTrust
SplunkTrust

YOu need to use foreach command for that OR addtotals

host=foo sourcetype=top | timechart span=1m sum(pctCPU) BY COMMAND limit=3 useother=f | addtotals

or

host=foo sourcetype=top | timechart span=1m sum(pctCPU) BY COMMAND limit=3 useother=f | eval Total=0| foreach * [eval Total=Total+'<<FIELD>>']

woodcock
Esteemed Legend

Like this (NOTE: You should not use sum the way that you were):

host=foo sourcetype=top | timechart span=1m avg(pctCPU) BY COMMAND limit=3 useother=f
| eval _combined = 0
| foreach * [ eval _combined = _combined + <<FIELD>> ]
| eval _combined = _combined/3
| rename _combined AS combined
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

I don't think you want line 4 to be in there for "total" cpu time.

Is there any functional advantage to using _combined rather than combined? The code seems to function the same either way. Perhaps a useful personal naming convention for working fields?

0 Karma

woodcock
Esteemed Legend

It is as nonsensical to have a "sum of percentages" as it is to have a "total average". I am making a guess at what he is really needing to do, given that the metric that he is working with is an "average" of sorts ( pctCPU ). It makes NO SENSE to do sum(pctCPU); that's the point. Therefore, my line 4 is necessary to continue working as averages (sum the 3 and divide by 3). The trick of using _combined vs. combined is so that when you do foreach *, the wildcard will not include the "invisible" ( _* ) fields. Try this:

| makeresults 
| eval a=1, b=2, c=3, _d=4, e=5
| eval _clump="clumped:" 
| foreach * [eval _clump = _clump . <<FIELD>>]
| rename _clump AS clump

Notice that the value for _d is not included and notice also that clumped only appears once. Notice the "brokenness" of this, which would otherwise require extra gymnastics inside of the foreach:

| makeresults 
| eval a=1, b=2, c=3, _d=4, e=5
| eval clump="clumped:" 
| foreach * [eval clump = clump . <<FIELD>>]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...