Timechart with top values split by host

bbknowles — Fri, 03 May 2019 14:00:13 GMT

Hi.
Let me provide some backstory. I've been assigned some dashboards. I need to make them interactive, but one has about 250 servers and the other has nearly 5000 servers. I get truncated results for the multiple panels when I try to run them.

So I've been trying to narrow the results down with minimal success. Currently, I'm focusing on the smaller dashboard. I am now looking for just the outliers for each panel, but that still returns truncated results.

Now I'm trying to give the user the option to select the up to the Top 50 results, but each chart is a timechart with an eval statement split by host.

Here is an example:
index=perfmon eventtype=Hyperspace_Perfmon counter = "Processor Queue Length"
| timechart span=1m values(Value) as Value by host limit=0 useother=f
|fillnull Value=0 | untable _time, host, Value
| timechart span=15m sum(eval(if(Value>20,1,0))) as CPU by host $Toptoken$ usenull=f
| sort -CPU

This limits the number of hosts to 50, but only gives me the first 50 hosts.

If I add the token, to the sort line, I only get 50 records.

Re: Timechart with top values split by host

bbknowles — Wed, 30 Sep 2020 00:20:49 GMT

I think I just answered it myself. I'm now using WHERE max in top50.

index=perfmon eventtype=Hyperspace_Perfmon counter = "Processor Queue Length"
| timechart span=1m values(Value) as Value by host limit=0 useother=f
|fillnull Value=0 | untable _time, host, Value
| timechart span=$span_token$ sum(eval(if(Value>$threshold6$,1,0))) as CPU by host WHERE max in $Toptoken$ usenull=f
| sort -CPU

topic Re: Timechart with top values split by host in Splunk Search

Timechart with top values split by host

Re: Timechart with top values split by host