topic visualization in Splunk Enterprise

visualization

SN1 — Thu, 13 Feb 2025 06:31:03 GMT

Hello I have this search
| rest splunk_server=MSE-SVSPLUNKI01 /services/server/status/resource-usage/hostwide
| eval cpu_usage = cpu_system_pct + cpu_user_pct
| where cpu_usage > 10

I want to this search to give a graph visualization of total cpu_usage every 4 hours.

Re: visualization

kiran_panchavat — Thu, 13 Feb 2025 06:46:22 GMT

@SN1

You can modify your search to aggregate cpu_usage over 4-hour intervals and visualize it.

Re: visualization

livehybrid — Thu, 13 Feb 2025 07:18:55 GMT

Hi @SN1

You can achieve this with the following search - please see screenshot below for actual example output too.

index="_introspection" component=Hostwide earliest=-4h host=<yourHostname> | eval cpu_usage = 'data.cpu_system_pct' + 'data.cpu_user_pct' | timechart span=5m avg(cpu_usage) as avg_cpu_usage

I dont think the other answer provided would work because the REST endpoint does not output a timeseries, its a one-time view of this data.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: visualization

SN1 — Thu, 13 Feb 2025 07:07:46 GMT

SO i want total cpu usage for indexer only

Re: visualization

livehybrid — Thu, 13 Feb 2025 07:09:02 GMT

That is fine, just set host=<yourIndexer> after index=_introspection and you should get this.