Splunk Search

join in search string

Splunk_U
Path Finder

I have a search string

index=os source=vmstat
| multikv fields memUsedPct memTotalMB memFreeMB
| stats avg(memUsedPct) as avgMemPct max(memUsedPct) as peakMemPct avg(memUsedMB) as avgMemMb max(memUsedMB) as peakMemMb by host
| join host [ search index=os source=cpu
| multikv fields pctIdle

| search all

| eval Percent_CPU_Load = 100 - pctIdle

| stats avg(Percent_CPU_Load) as avgCpuPct max(Percent_CPU_Load) as peakCpuPct by host

Now is there any way that I can get the same result without doing join??

Tags (1)
0 Karma

cramasta
Builder

How does this work?

index=os AND ( source=cpu OR source=vmstat) | multikv fields memUsedPct memTotalMB memFreeMB pctIdle | eval Percent_CPU_Load = 100 - pctIdle | stats avg(memUsedPct) as avgMemPct max(memUsedPct) as peakMemPct avg(memUsedMB) as avgMemMb max(memUsedMB) as peakMemMb avg(Percent_CPU_Load) as avgCpuPct max(Percent_CPU_Load) as peakCpuPct by host

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...