topic Re: Join command in Dashboards & Visualizations

How to use join command to output in graph dashboard?

jackin — Thu, 24 Mar 2022 15:24:26 GMT

Hi,

I am using the below query to bring the output in graph dashboard but this query gives Disk memory values is same . I have attached the output also. Can anyone help me

Query:

index=oswin sourcetype="Perfmon:Processor" host=COPYCAR01 
| timechart avg(cpu_load_percent) as CPU span=15min 
| join type=left host
[| mstats avg("Memory.%_Committed_Bytes_In_Use") as Memory WHERE index=oswinperf AND host=COPYCAR01 span=15min ] 
| join type=left host
[| mstats avg("LogicalDisk.%_Free_Space") as Diskfree WHERE index=oswinperf AND host=COPYCAR01 span=15min 
| eval DISK=100 - Diskfree 
| table _time,DISK]

Output:

_time               CPU                  DISK            Memory
2022-03-24 09:00:00 55.78524325650826 57.29944034187627 11.84846114177454
2022-03-24 09:15:00 59.38775699798989 57.29944034187627 11.84846114177454
2022-03-24 09:30:00 56.71582822628451 57.29944034187627 11.84846114177454

Re: Join command

diogofgm — Thu, 24 Mar 2022 13:12:30 GMT

You are getting the same because you are joining by host and not by host/_time

Since you're getting already metrics data why not use CPU metrics data as well? That would make you search something like this:

| mstats avg("Processor.%_Processor_Time") AS CPU avg("Memory.%_Committed_Bytes_In_Use") as Memory avg("LogicalDisk.%_Free_Space") as Diskfree WHERE index=oswinperf AND host=COPYCAR01 span=15min | eval DISK=100 - Diskfree | table _time CPU Memory DISK

Way better since you do not need to use join.

Re: Join command

jackin — Thu, 24 Mar 2022 13:35:02 GMT

Hi@diogofgm

Actually the cpu metric did not return the correct values. thats why

can you help me to bring the output?

Re: Join command

venky1544 — Thu, 24 Mar 2022 14:54:33 GMT

Hi @jackin

what is the object and counter configured for you cpu metrics in your splunk and is your CPU data in sourcetype="Perfmon:Processor" i thought it is usually in different sourcetype

like Memory.%_Committed_Bytes_In_Use is for memory

and LogicalDisk.%_Free_Space is for free space

Re: Join command

diogofgm — Thu, 24 Mar 2022 14:59:59 GMT

In search and report ,in the analytics tab you can check which metrics you're collecting