topic Re: Generate graph from 'CPU RAM process' log in Getting Data In

Generate graph from 'CPU RAM process' log

splunk_zen — Mon, 28 Sep 2020 11:38:50 GMT

How should I configure the Search (and Report) so to get a CPU & RAM line chart (the values not a count) by process?

This is my current log file format,

1.3 0.1 python

2.9 11.3 /usr/libexec/mysqld --basedir=/usr

2.0 0.1 sqlplus

0.0 0.1 ./smt_collector

0.0 0.0 ora_dia0_zabbix

0.0 0.0 /opt/ptin/zabbix/sbin/zabbix_agentd

0.0 0.0 /opt/ptin/zabbix/sbin/zabbix_agentd

0.1 0.9 splunkd

0.1 0.2 ./uzo_collector

0.3 0.5 /bin/sh

This is my current Search,

source="/opt/splunk/monitoring_logs/ps.log" | rex field=_raw "(?<field1>\d*) (?<field2>\d*) (?<field3>\s*)" | timechart

Re: Generate graph from 'CPU RAM process' log

kristian_kolb — Mon, 09 Apr 2012 13:47:30 GMT

Do these rex extractions really work, e.g. does \d* match 0.1?

If it doesn't, I'd try

rex field=_raw "(?<field1>[\S]+)\s+(?<field2>\S+)\s+(?<field3>.*)$"

As for the charting, have you tried the "Advanced Charting" wizard? I believe that it is still found under the "Dashboards & Views" menu in the Search app. The following search gave what I believe is what you want;

your_search| multikv noheader=t | rex (?<CPU>\S+)\s+(?<MEM>\S+)\s+(?<PROCESS>.*)$ | timechart values(CPU) AS CPU_usage values(MEM) AS Memory_usage by PROCESS

The charting options were, chart type: line, Multi-series mode: combined, Missing values: connect.

Hope this helps,

Kristian

Re: Generate graph from 'CPU RAM process' log

splunk_zen — Mon, 09 Apr 2012 16:57:00 GMT

Thanks kristian. Like you've already guessed I'm still not experienced in the search parameters, I'll take a look into multikv and the other structures.

Re: Generate graph from 'CPU RAM process' log

kristian_kolb — Mon, 09 Apr 2012 19:20:42 GMT

You're most welcome 🙂 /k