topic Re: perfmon counter as column for hosts issue in Splunk Dev

perfmon counter as column for hosts issue

k_harini — Sat, 10 Jun 2017 12:27:29 GMT

Hi,
I have data extracted from windows perfmon logs
Query I used
index=perfmon_cpu counter="% Idle time" OR counter="% User Time" OR counter="% Processor Time"|stats latest(Value) as "Percent" by host counter

Here I get all the hosts, with counter and %. I want all the counters to be column with Values as %for hosts. If I use transpose - hosts are also getting as columns. I don't want that. Any idea to retain hosts and changing counters and their values in columns. Counters are idle time, user time and processor time. Values are in %. Please help

Re: perfmon counter as column for hosts issue

maciep — Sat, 10 Jun 2017 12:37:36 GMT

I think you might want chart instead of stats here.

chart latest(Value) as value over counter by host

or maybe over host by counter (can never remember)

And there is also xyseries ,which can make your stats results look the way you want as well.
https://answers.splunk.com/answers/93327/xyseries-vs-chart-over-by.html

Re: perfmon counter as column for hosts issue

k_harini — Sun, 11 Jun 2017 15:42:47 GMT

Thank you 🙂