Hi ,
I need the help to write splunk query for calculating CPU Linux load average for last 1,5 and 15 mins. I have splunk TA nix app and collected the metrics vmstat_metric.loadAvg1mi and used this metrics for last 1 min query. But I am not sure how to calculate the load average for last 5 and 15 mins. can anyone
Hi @mm12,
you have to categorize your data, using eval, something like this:
your_search
| eval period=case(_time<60,"1",_time<300,"2",_time<1500,"3")
| stats
avg(eval(if(_time<60,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_1m
avg(eval(if(_time<300,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_5m
avg(eval(if(_time<1500,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_15m
Ciao.
Giuseppe