Splunk Search

Tracking how much an item moves vs. a baseline.

jbsplunk
Splunk Employee
Splunk Employee

I was asked to look into building a report on how much an item moves vs. a baseline. I was trying to compare CPU Utilization by process over a month, and comparing that to utilization on a given day. After that, I wanted to compare the difference in ranking. How could this be done?

Tags (1)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

I could see where something like this could be modified to be made useful for others, so I thought I would share the search:

index="os" sourcetype="ps" host="*"  earliest=-30d@d
| multikv fields pctCPU, COMMAND
| chart avg(pctCPU) as pctCPUMonthly by COMMAND
| sort limit=10 - COMMAND
| streamstats count as MonthRank
| append [search index="os" sourcetype="ps" host="*"  earliest=-1d@d | multikv fields pctCPU, COMMAND | chart avg(pctCPU) as pctCPUDaily by COMMAND | sort limit=10 - COMMAND | streamstats count as DayRank]
| stats first(MonthRank) as  MonthRank first(DayRank) as DayRank by COMMAND
| eval difference=MonthRank-DayRank
| fields + COMMAND, MonthRank, DayRank, difference

I hope this is useful to someone.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

I could see where something like this could be modified to be made useful for others, so I thought I would share the search:

index="os" sourcetype="ps" host="*"  earliest=-30d@d
| multikv fields pctCPU, COMMAND
| chart avg(pctCPU) as pctCPUMonthly by COMMAND
| sort limit=10 - COMMAND
| streamstats count as MonthRank
| append [search index="os" sourcetype="ps" host="*"  earliest=-1d@d | multikv fields pctCPU, COMMAND | chart avg(pctCPU) as pctCPUDaily by COMMAND | sort limit=10 - COMMAND | streamstats count as DayRank]
| stats first(MonthRank) as  MonthRank first(DayRank) as DayRank by COMMAND
| eval difference=MonthRank-DayRank
| fields + COMMAND, MonthRank, DayRank, difference

I hope this is useful to someone.

carasso
Splunk Employee
Splunk Employee

I think there's an error here:

"| sort limit=10 - COMMAND"

You're sorting by the NAMES (i.e. "COMMAND") of the commands from Z to A, and then using that order as the MonthRank? I think you want

"| sort limit=10 - pctCPUMonthly"
0 Karma

jrodman
Splunk Employee
Splunk Employee

Might be useful to talk out how the search does its magic?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...