topic Re: Want to see data by host in Getting Data In

Want to see data by host

sunnyparmar — Tue, 16 Jun 2015 08:46:42 GMT

Hi,

In the below given query i want to see the data by host but unable to see. Kindly suggest

index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) by host | timechart avg(Value) by counter

Thanks
Ankit

Re: Want to see data by host

stephane_cyrill — Tue, 16 Jun 2015 08:50:18 GMT

HI TRY THIS

 index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" )  | timechart avg(Value)  by host

Re: Want to see data by host

sunnyparmar — Tue, 16 Jun 2015 09:22:20 GMT

Hey,

Thanks for the reply but if I did it by host only then query runs and it is showing data by host. Then when I will click on show events under it, it will show data for further parameter (Avg. Disk sec/Read and Avg. Disk sec/Write)but what I want that it will show data hostwise for both (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write") counters in output.

and

Second query is not running.. it is giving an error.

Regards
Ankit

Re: Want to see data by host

chimell — Tue, 16 Jun 2015 10:48:34 GMT

Hi sunnyparmar
Try this search code

|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]

Re: Want to see data by host

sunnyparmar — Tue, 16 Jun 2015 11:04:14 GMT

Hey,

thanks for the reply but it is given below error when I am running the below query

index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) | set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]

ERROR

Error in 'set' command: This command must be the first command of a search.

Thanks & Regards
Sunny

Re: Want to see data by host

chimell — Tue, 16 Jun 2015 11:08:18 GMT

Don't add something to the search code that i gave you just run it
it works well will my data
Delete index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) and re-run

Re: Want to see data by host

chimell — Tue, 16 Jun 2015 11:12:02 GMT

Note that the search which contain a set command always begin with | set

Re: Want to see data by host

sunnyparmar — Tue, 16 Jun 2015 11:20:41 GMT

Ultimate.. it works...thanks once again

Re: Want to see data by host

chimell — Tue, 16 Jun 2015 12:11:47 GMT

Good thanks