Reporting

Reporting by parsing entries in fields

er1kr1984
New Member

Hi All

i am new to Splunk and hope this is not to much of a stupid question.

i am looking to create a report in the form of a line graph that shows the following values CPU values by time on the Y axis and cpu usage on the X axis

2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=65.17%
2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=62.09%
2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=60.17%
2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=59.12%
2013-06-04 14:01:48,192 INFO [] [6_ResourceMonitor] Total CPU usage per CPU: 0=59.09%

i have tried several different things but stuck at the moment any help would be fantastic

Tags (1)
0 Karma

gfuente
Motivator

Hello,

First of all, you´ll need to extract the values you want to chart in a new field with the rex command:

...| rex "CPU:\s0=(?< cpu_values >\d+\.\d+)" | ...

*without the spaces before and after the cpu_values

Then you need to use time chart, you´ll search would look something similar to:

sourcetype="mysourcetype" | rex "CPU:\s0=(?< cpu_values >\d+\.\d+)" | timechart avg(cpu_values)

Regards

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...