topic How can I get a load average of cpu using splunk query? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-load-average-of-cpu-using-splunk-query/m-p/459054#M129634 <P>I am seeing 3 load average values, need to get a query to get 3 values and get an average.</P> Fri, 27 Jul 2018 16:24:58 GMT udaymadupathi 2018-07-27T16:24:58Z How can I get a load average of cpu using splunk query? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-load-average-of-cpu-using-splunk-query/m-p/459054#M129634 <P>I am seeing 3 load average values, need to get a query to get 3 values and get an average.</P> Fri, 27 Jul 2018 16:24:58 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-load-average-of-cpu-using-splunk-query/m-p/459054#M129634 udaymadupathi 2018-07-27T16:24:58Z Re: How can I get a load average of cpu using splunk query? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-load-average-of-cpu-using-splunk-query/m-p/459055#M129635 <P>please provide the query you are using and a sample event of your data so we can help you</P> Fri, 27 Jul 2018 16:39:21 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-load-average-of-cpu-using-splunk-query/m-p/459055#M129635 kmaron 2018-07-27T16:39:21Z Re: How can I get a load average of cpu using splunk query? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-load-average-of-cpu-using-splunk-query/m-p/459056#M129636 <PRE><CODE>index="osw" host="ausilsoaapp49.us.dell.com" sourcetype="oswtop"| multikv fields load average | (?[\d.]+), (?[\d.]+), (?[\d.]+) |stats avg("Total load avg time") as "Average load avg" top - 11:55:37 up 15 days, 20:56, 0 users, load average: 4035.66, 4033.69, 403 Tasks: 4315 total, 1 running, 4314 sleeping, 0 stopped, 0 zombie %Cpu(s): 6.2 us, 7.3 sy, 0.0 ni, 86.3 id, 0.0 wa, 0.0 hi, 0.2 si, 0.0 st KiB Mem : 16260328 total, 931420 free, 12506104 used, 2822804 buff/cache KiB Swap: 2097148 total, 2097148 free, 0 used. 2042484 avail Mem </CODE></PRE> Fri, 27 Jul 2018 16:56:23 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-load-average-of-cpu-using-splunk-query/m-p/459056#M129636 udaymadupathi 2018-07-27T16:56:23Z Re: How can I get a load average of cpu using splunk query? https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-load-average-of-cpu-using-splunk-query/m-p/459057#M129637 <P>Okay, given your data format, I don't think that <CODE>multikv</CODE> is going to properly extract your data. <CODE>multikv</CODE> is designed to get columnar data, ( see <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv</A>) and this data looks nothing like that.</P> <P>Try this...</P> <PRE><CODE> index="osw" host="ausilsoaapp49.us.dell.com" sourcetype="oswtop" | rex "load average:\s*(?&lt;load1&gt;[\d\.]*),\s*(?&lt;load2&gt;[\d\.]*),\s*(?&lt;load3&gt;[\d\.]*)" | fillnull value=0 load1 load2 load3 | eval LoadAverage = round((load1+load2+load3)/3,2) </CODE></PRE> Sun, 29 Jul 2018 04:19:07 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-load-average-of-cpu-using-splunk-query/m-p/459057#M129637 DalJeanis 2018-07-29T04:19:07Z