topic Re: Please see the below, trying to calculate avgCpuUtilization maxCpuUtilization for differect DC in Splunk Enterprise

qq

chandankr — Fri, 20 Jan 2023 16:28:42 GMT

Re: Please see the below, trying to calculate avgCpuUtilization maxCpuUtilization for differect DC

ITWhisperer — Fri, 20 Jan 2023 08:33:58 GMT

Try something like this

| ...... base search | rex field=_raw "measResults\W(?<avgCpuUtilization>\d{0,3})\s(?<maxCpuUtilization>\d{0,3})" | rex field=_raw "PLMN-PLMN\W\w+-\d\W\w\w\w-\d{0,3}.\d{0,3}.\d{0,3}.\d{0,3}@(?<data_center>\w+-\w+)" | rex field=_raw " endTime\D\D(?<year>\d{0,4})\D(?<month>\d\d)\D(?<date>\d\d)" | eval order = case(month==1,"january", month==2,"february", month==3,"march", month==4,"april", month==5,"may", month==6,"june", month==7,"july", month==8,"august", month==9,"september", month==10,"october", month==11,"november", 1==1, "december") | chart avg(avgCpuUtilization) as AvgCpuLoad max(maxCpuUtilization) as MaxCpuLoad by order, data_center | eval order = upper(order) | rename "AvgCpuLoad: LVS_DC" as "AvgCpuLoad-UKDC", "AvgCpuLoad: RB_DC" as "AvgCpuLoad-USDC", "MaxCpuLoad: LVS_DC" as "MaxCpuLoad-UKDC", "MaxCpuLoad: RB_DC" as "MaxCpuLoad-USDC"

Re: Please see the below, trying to calculate avgCpuUtilization maxCpuUtilization for differect DC

chandankr — Fri, 20 Jan 2023 08:42:08 GMT

thanks @ITWhisperer for your reply . i am trying to fetch data based on data_center and create four fields that is AvgCpuLoad-UKDC MaxCpuLoad-UKDC AvgCpuLoad-USDC MaxCpuLoad-USDC.

Re: Please see the below, trying to calculate avgCpuUtilization maxCpuUtilization for differect DC

chandankr — Fri, 20 Jan 2023 08:42:27 GMT

request your help on this

Re: Please see the below, trying to calculate avgCpuUtilization maxCpuUtilization for differect DC

ITWhisperer — Fri, 20 Jan 2023 08:45:47 GMT

If what I suggested doesn't work for you, perhaps you could share some of your raw events in a code block </> and the output from my suggestion?