- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to graph timechart of top 5 processes for ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All. If the user selects %_Processor_Time,then I need to show the graph for avg(%_Processor_Time) for top 5 processes that consumes %_Processor_Time. I got the top 5 processes using the search but unable to write the timechart command in the same query to display graph.
index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" | eval Process=upper(instance) | table Process %_Processor_Time | sort - %_Processor_Time | dedup Process | head 5
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Throw it all into a subsearch that returns the processes, then run your timechart command in the outer search:
index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" [search index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" | eval Process=upper(instance) | table Process %_Processor_Time | sort - %_Processor_Time | dedup Process | head 5 | fields Process] | timechart avg(%_Processor_Time) by Process
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Throw it all into a subsearch that returns the processes, then run your timechart command in the outer search:
index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" [search index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" | eval Process=upper(instance) | table Process %_Processor_Time | sort - %_Processor_Time | dedup Process | head 5 | fields Process] | timechart avg(%_Processor_Time) by Process
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks I used the same and its working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can anyone please help me on this?
Introducing the Splunk Community Dashboard Challenge!
Get the T-shirt to Prove You Survived Splunk University Bootcamp
Wondering How to Build Resiliency in the Cloud?
