topic Re: How to import CPU load from Check Point logs? in Monitoring Splunk

How to import CPU load from Check Point logs?

k909 — Tue, 29 Sep 2020 12:05:32 GMT

Hi all,
we're trying to import archive logs from checkpoint (gaia).
In one archive it includes many hardware params.
Each file has a unix timestamp (cpu_load.1480888800) 866 each day
cut cpu_load.1480888800

Average:     CPU   %user   %nice    %sys %iowait    %irq   %soft  %steal   %idle    intr/s
Average:     all    0.54    0.00    0.47    0.08    0.02    1.13    0.00   97.75  18997.50
Average:       0    4.00    0.00    2.90    3.00    0.10    3.20    0.00   86.80   1060.80
Average:       1    0.10    0.00    0.40    0.00    0.00    0.80    0.00   98.80      0.00
Average:      12    0.30    0.00    0.00    0.00    0.10    0.50    0.00   99.20    637.00
Average:      39    0.10    0.00    0.60    0.00    0.10    1.10    0.00   98.10   1267.90

How import cpu load for each core?

Re: How to import CPU load from Check Point logs?

richgalloway — Thu, 08 Dec 2016 13:12:16 GMT

Have you tried importing the file as a CSV with the field delimiter set to space?

Re: How to import CPU load from Check Point logs?

k909 — Tue, 29 Sep 2020 12:05:55 GMT

Hi,
Thanks for answer, but space delimeter not help.
try to change props.conf
[cpu_61k_csv]
FIELDS = Average,CPU,user,nice,sys,iowait,irq,soft,steal,idle,intr/s
DELIMS = " "

But space delimeter its different, it depend from value from row

Re: How to import CPU load from Check Point logs?

richgalloway — Fri, 09 Dec 2016 12:48:03 GMT

From your edited question it appears the delimiter is tab rather than space. Try using \t as the DELIMS value.

Re: How to import CPU load from Check Point logs?

mnatkin_splunk — Fri, 09 Dec 2016 13:46:42 GMT

Part of the beauty of managing the GAiA OS is that the vast majority is directly derived from RedHat EL (depending on the version of GAiA, predominantly RHEL3 or RHEL5).

The output you're looking to ingest is from "mpstat", a standard *Nix application.

The *NIX TA (available at https://splunkbase.splunk.com/app/833/ ) does the necessary work to make sense of this input type without reinventing the wheel. The sourcetype will be "cpu".