Splunk Search

How can I get a load average of cpu using splunk query?

udaymadupathi
New Member

I am seeing 3 load average values, need to get a query to get 3 values and get an average.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Okay, given your data format, I don't think that multikv is going to properly extract your data. multikv is designed to get columnar data, ( see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv) and this data looks nothing like that.

Try this...

 index="osw" host="ausilsoaapp49.us.dell.com" sourcetype="oswtop"
| rex "load average:\s*(?<load1>[\d\.]*),\s*(?<load2>[\d\.]*),\s*(?<load3>[\d\.]*)"
| fillnull value=0 load1 load2 load3
| eval LoadAverage =  round((load1+load2+load3)/3,2)

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Okay, given your data format, I don't think that multikv is going to properly extract your data. multikv is designed to get columnar data, ( see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv) and this data looks nothing like that.

Try this...

 index="osw" host="ausilsoaapp49.us.dell.com" sourcetype="oswtop"
| rex "load average:\s*(?<load1>[\d\.]*),\s*(?<load2>[\d\.]*),\s*(?<load3>[\d\.]*)"
| fillnull value=0 load1 load2 load3
| eval LoadAverage =  round((load1+load2+load3)/3,2)
0 Karma

udaymadupathi
New Member
index="osw" host="ausilsoaapp49.us.dell.com" sourcetype="oswtop"| multikv fields load average |   (?[\d.]+), (?[\d.]+), (?[\d.]+) |stats avg("Total load avg time") as "Average load avg"

top - 11:55:37 up 15 days, 20:56,  0 users,  load average: 4035.66, 4033.69, 403
Tasks: 4315 total,   1 running, 4314 sleeping,   0 stopped,   0 zombie
%Cpu(s):  6.2 us,  7.3 sy,  0.0 ni, 86.3 id,  0.0 wa,  0.0 hi,  0.2 si,  0.0 st
KiB Mem : 16260328 total,   931420 free, 12506104 used,  2822804 buff/cache
KiB Swap:  2097148 total,  2097148 free,        0 used.  2042484 avail Mem 
0 Karma

kmaron
Motivator

please provide the query you are using and a sample event of your data so we can help you

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...