Splunk Search

Charting values from performance record

snowmizer
SplunkTrust
SplunkTrust

I've got a log file that contains, time, controller, and CPU % used. I need to create a time chart that plots the CPU % from the record. I've messed with different timechart and stats functions but nothing pulls the exact CPU % from the record and plots it by time.

What's the best way to do this?

Thanks.

Tags (1)
0 Karma
1 Solution

christopherutz
Path Finder

I suspect what you are not liking is the fact that timechart buckets events and you must supply some aggregator (sum, max, avg) for your field? Have you tried decreasing your span such that you can guarantee there will only be one event per bucket? In this case an average becomes the exact value you are looking for.

my search terms | timechart span=5sec avg(CPU%)

View solution in original post

snowmizer
SplunkTrust
SplunkTrust

Thanks again for the suggestion.

0 Karma

christopherutz
Path Finder

I suspect what you are not liking is the fact that timechart buckets events and you must supply some aggregator (sum, max, avg) for your field? Have you tried decreasing your span such that you can guarantee there will only be one event per bucket? In this case an average becomes the exact value you are looking for.

my search terms | timechart span=5sec avg(CPU%)

snowmizer
SplunkTrust
SplunkTrust

Thanks for the suggestion. I forgot that span can be used with timechart.

My data is broken up in 1 minute periods so using the span=1m resulted in too many buckets. I think I'll be fine if I just average the data over 5 minute periods. I think anything less would be too granular anyway. If I want the 1 minute data I can just look at the raw data for that period.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...