Splunk Search

Tracking how much an item moves vs. a baseline.

jbsplunk
Splunk Employee
Splunk Employee

I was asked to look into building a report on how much an item moves vs. a baseline. I was trying to compare CPU Utilization by process over a month, and comparing that to utilization on a given day. After that, I wanted to compare the difference in ranking. How could this be done?

Tags (1)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

I could see where something like this could be modified to be made useful for others, so I thought I would share the search:

index="os" sourcetype="ps" host="*"  earliest=-30d@d
| multikv fields pctCPU, COMMAND
| chart avg(pctCPU) as pctCPUMonthly by COMMAND
| sort limit=10 - COMMAND
| streamstats count as MonthRank
| append [search index="os" sourcetype="ps" host="*"  earliest=-1d@d | multikv fields pctCPU, COMMAND | chart avg(pctCPU) as pctCPUDaily by COMMAND | sort limit=10 - COMMAND | streamstats count as DayRank]
| stats first(MonthRank) as  MonthRank first(DayRank) as DayRank by COMMAND
| eval difference=MonthRank-DayRank
| fields + COMMAND, MonthRank, DayRank, difference

I hope this is useful to someone.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

I could see where something like this could be modified to be made useful for others, so I thought I would share the search:

index="os" sourcetype="ps" host="*"  earliest=-30d@d
| multikv fields pctCPU, COMMAND
| chart avg(pctCPU) as pctCPUMonthly by COMMAND
| sort limit=10 - COMMAND
| streamstats count as MonthRank
| append [search index="os" sourcetype="ps" host="*"  earliest=-1d@d | multikv fields pctCPU, COMMAND | chart avg(pctCPU) as pctCPUDaily by COMMAND | sort limit=10 - COMMAND | streamstats count as DayRank]
| stats first(MonthRank) as  MonthRank first(DayRank) as DayRank by COMMAND
| eval difference=MonthRank-DayRank
| fields + COMMAND, MonthRank, DayRank, difference

I hope this is useful to someone.

carasso
Splunk Employee
Splunk Employee

I think there's an error here:

"| sort limit=10 - COMMAND"

You're sorting by the NAMES (i.e. "COMMAND") of the commands from Z to A, and then using that order as the MonthRank? I think you want

"| sort limit=10 - pctCPUMonthly"
0 Karma

jrodman
Splunk Employee
Splunk Employee

Might be useful to talk out how the search does its magic?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...