I have Netapp LUNS mapped to a Centos server. when I run iostat, I see all the individual disks that are mapped. I have three LUNs - for this purpose they are four disk LUNS: Lun1=(sda1, sda2, sda3, sda4), Lun2=(sda5, sda6, sda7, sda8) and Lun3=(sda9, sda10, sda11, sda12). I want to find the wKB_PS and rKB_PS to check the SAN performance. I wrote a search: index=os sourcetype=iostat host=databseservername | multikv | search Device="sda1" |time chart span=1m xax(wKB_PS) max(rKB_PS)
that works great on a single device/drive. How to I do four disk devices in one aggregated LUN?
I'm assuming you want to sum up the maximum read/write for a four-disk set?
... | search Device="sda1" OR Device="sda2" OR Device="sda3" OR Device="sda4" | timechart span=1m max(wKB_PS) max(rKB_PS) by Device | addtotals field=read *rKB_PS* | addtotals field=write *wKB_PS* | table _time read write
That should give you a timechart with two fields, read and write showing the sum over those four devices.
I'm assuming you want to sum up the maximum read/write for a four-disk set?
... | search Device="sda1" OR Device="sda2" OR Device="sda3" OR Device="sda4" | timechart span=1m max(wKB_PS) max(rKB_PS) by Device | addtotals field=read *rKB_PS* | addtotals field=write *wKB_PS* | table _time read write
That should give you a timechart with two fields, read and write showing the sum over those four devices.
As it turns out the parameter is fieldname, not field 🙂
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/addtotals
First - THANK YOU for the swift and very helpful response. There is just a wee bit of tweaking left, to get the LUN totals.
I get the following error message: Error in 'addtotals' command: Invalid argument: 'field=write'
I have tried is 'field = write' as well, same error message.
The search works up until the first 'addtotals' statement. Any thoughts?