topic Re: How to combine 2 searches to get show values and percentage of host and instance fields? in Splunk Search

How to combine 2 searches to get show values and percentage of host and instance fields?

shreyasathavale — Tue, 21 Mar 2017 14:35:01 GMT

Hi,

I have 2 searches, for 1st output is values (2GB) and other gives output as percent (2%) .

index=windows sourcetype="Perfmon:Free Disk Space" role=ABC  counter="Free Megabytes"  instance!=_Total| eval Value=(Value/1024)|eval Value= round(Value,2)|chart values(Value) by host, instance

index=windows sourcetype="Perfmon:Free Disk Space" role=ABC   counter="% Free Space" instance!=_Total|eval Value= round(Value,2)|chart values(Value)  by  host,instance

I want output to show values as well as percent for the host and instance (C/D)...
Any ideas will be appreciated 🙂

Thanks

Re: How to combine 2 searches to get show values and percentage of host and instance fields?

gcusello — Tue, 21 Mar 2017 15:02:14 GMT

hi shreyasathavale,
try something like this:

index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="Free Megabytes" instance!=_Total 
| eval Value=round(Value/1024,2)
| stats values(Value) AS "Free Megabytes" by host, instance
| append [ search 
   index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="% Free Space" instance!=_Total 
   | eval Value=round(Value,2)
   | stats values(Value) AS "% Free Space" by host, instance
   ]
| stats values("Free Megabytes") AS "Free Megabytes" values("% Free Space") AS "% Free Space" by host, instance

Bye.
Giuseppe

Re: How to combine 2 searches to get show values and percentage of host and instance fields?

cmerriman — Tue, 21 Mar 2017 15:06:13 GMT

you could do:

index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="Free Megabytes" instance!=_Total| eval Value=(Value/1024)|eval Value= round(Value,2)|chart values(Value) by host, instance|join type=left host [search index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="% Free Space" instance!=_Total|eval Value= round(Value,2)|chart values(Value) by host,instance]

but that has limitations with the join, or you could try this:

index=windows sourcetype="Perfmon:Free Disk Space" role=ABC (counter="Free Megabytes" OR counter="% Free Space") instance!=_Total    |eval Value=if(counter="Free Megabytes",round((Value/1024),2),round(Value,2))
|chart values(Value) by host, instance

Re: How to combine 2 searches to get show values and percentage of host and instance fields?

somesoni2 — Tue, 21 Mar 2017 15:08:56 GMT

Try like this.

index=windows sourcetype="Perfmon:Free Disk Space" role=ABC counter="Free Megabytes" OR counter="% Free Space" instance!=_Total|eval Value= round(Value/1024,2) | eval instance=instance.":".counter|chart values(Value) by host, instance

Re: How to combine 2 searches to get show values and percentage of host and instance fields?

woodcock — Tue, 21 Mar 2017 18:43:29 GMT

Like this:

index=windows sourcetype="Perfmon:Free Disk Space" role=ABC  (counter="Free Megabytes" OR counter="% Free Space")  instance!=_Total
| eval Value=if((counter="Free Megabytes", Value/1024, round(Value,2)) | chart values(Value) by host, instance

Re: How to combine 2 searches to get show values and percentage of host and instance fields?

shreyasathavale — Wed, 22 Mar 2017 06:09:09 GMT

Thanks Guiseppe, I was going for "join" but append is anytime better 🙂

Re: How to combine 2 searches to get show values and percentage of host and instance fields?

woodcock — Wed, 22 Mar 2017 15:22:05 GMT

The append command has the same downsides as join does. Did you try any of the answers that do not use either?