topic Re: Splunk Query not generating proper output in Getting Data In

Splunk Query not generating proper output

shreyasathavale — Thu, 17 Apr 2014 23:19:00 GMT

Hi,
We have joined 2 queries for output.When we run individual query we are getting the proper output but when combined we are not getting it. It would be helpful if anyone give thoughts about it.
Queries are as follows:

index=perfmon counter="% Processor Time" source="Perfmon:cputime" earliest=-15m | stats avg(Value) as CpuUsage by role,host|where CpuUsage > 10

index=perfmon counter="% Processor Time"source="Perfmon:Process" | top 6 instance by host|fields instance,host

Re: Splunk Query not generating proper output

HiroshiSatoh — Fri, 18 Apr 2014 01:16:40 GMT

Do you join? Not add?

[join]
index=perfmon counter="% Processor Time" source="Perfmon:cputime" earliest=-15m | stats avg(Value) as CpuUsage by role,host|where CpuUsage > 10 |join host [index=perfmon counter="% Processor Time"source="Perfmon:Process" | top 6 instance by host|fields instance,host]

[ADD]
index=perfmon counter="% Processor Time" source="Perfmon:cputime" earliest=-15m | stats avg(Value) as CpuUsage by role,host|where CpuUsage > 10 |append [index=perfmon counter="% Processor Time"source="Perfmon:Process" | top 6 instance by host|fields instance,host]

Re: Splunk Query not generating proper output

shreyasathavale — Fri, 18 Apr 2014 02:06:55 GMT

I had used appendcols as well as join but was not able to get the output... I had tried join id [search index=]...I will still try the above .. Thanks..

Re: Splunk Query not generating proper output

linu1988 — Fri, 18 Apr 2014 06:04:39 GMT

I have 2 doubts

| stats avg(Value) as CpuUsage by role,host

from where u are getting roles?

Re: Splunk Query not generating proper output

shreyasathavale — Fri, 18 Apr 2014 17:08:00 GMT

Hi, I tried the above queries but it is only giving me top 1 instance instead of 3/4/5 .. My requirement is "If the 1st query is true then only run 2nd query else dont run" , since it takes lots of time for parsing.. Any help ??

Re: Splunk Query not generating proper output

shreyasathavale — Fri, 18 Apr 2014 19:39:43 GMT

I have mentioned roles in serverclass.conf