topic Re: Show max ,minimum and average values from a pool of host machines on a chart in Splunk Search

Show max ,minimum and average values from a pool of host machines on a chart

jbassi1 — Wed, 30 Sep 2020 02:40:00 GMT

I have the follow search which shows the call count being made to a number of hosts every 15mins

"cs_dataowner_id="ICTO-18172" cs_stage="PROD" |search source="dqs"| search "FetchTradesHistoric invoked"|timechart count as calls by host span=15m"

I want to show on a chart for each 15 min span the host which has had the max count, the minimum count and the overall average count

The purpose being it gives the user an idea of what host is being over and under utilized and allows it compare it against the average

Any ideas how I can incorporate that in a chart ?

Re: Show max ,minimum and average values from a pool of host machines on a chart

to4kawa — Mon, 21 Oct 2019 10:38:42 GMT

cs_dataowner_id="ICTO-18172" cs_stage="PROD" source="dqs" "FetchTradesHistoric invoked"
| timechart span=15m count as calls by host
| eventstats max(calls) as max_calls min(calls) as min_calls avg(calls) as average_calls
| stats values(max_calls) as max_calls, values(min_calls) as min_calls, values(average_calls) as average_calls
 ,values(eval(if(calls==max_calls), host, NULL)) as max_calls_host
 ,values(eval(if(calls==min_calls), host, NULL)) as min_calls_host
 ,values(eval(if(calls > average_calls), host, NULL)) as over_avg_host
 ,values(eval(if(calls < average_calls), host, NULL)) as under_avg_host

Hi,
After timechart, calculate the maximum value etc. with eventstats and display it with stats.

How about this?

Sorry, The query was wrong.

| makeresults count=10
| streamstats count
| eval host="host_".count
| eval calls=random() % 100
`comment("This is dummy data")`
| eventstats max(calls) as max_calls min(calls) as min_calls avg(calls) as average_calls
`comment("Change stats query")`
| stats values(max_calls) as max_calls, values(min_calls) as min_calls, values(average_calls) as average_calls
  ,values(eval(if(calls==max_calls, host, NULL))) as max_calls_host
  ,values(eval(if(calls==min_calls, host, NULL))) as min_calls_host
  ,values(eval(if(calls > average_calls, host, NULL))) as over_avg_host
  ,values(eval(if(calls < average_calls, host, NULL))) as under_avg_host

I think this is all right.

Re: Show max ,minimum and average values from a pool of host machines on a chart

jbassi1 — Wed, 30 Sep 2020 02:34:46 GMT

Thanks for the response

I'm not sure whether it down to the version of Splunk I am using , which is Splunk Version ...6.6.6.1, but the below line does not return any results

cs_dataowner_id="ICTO-18172" cs_stage="PROD" source="dqs" "FetchTradesHistoric invoked" | timechart span=15m count as calls by host

I have to use my original format below to get a resultset which it does for each host
cs_dataowner_id="ICTO-18172" cs_stage="PROD" |search source="dqs"| search "FetchTradesHistoric invoked"|timechart span=15m count as calls by host| eventstats max(calls) as max_calls min(calls) as min_calls avg(calls) as average_calls

To the above search if I then try to append the below again get no results is this a version or format issue ?
"| stats values(max_calls) as max_calls, values(min_calls) as min_calls, values(average_calls) as average_calls"

If I do the full search with the eval function included I get the syntax error below
"⚠ Error in 'stats' command: The eval expression for dynamic field 'eval(if(calls==max_calls), host, NULL)' is invalid. Error='The operator at ', host, NULL' is invalid.' "