topic Re: show top 5 CPU Usage vom VMware Hosts in Splunk Search

show top 5 CPU Usage vom VMware Hosts

pduvofmr — Wed, 30 Sep 2020 02:31:25 GMT

Hi Splunkies,

this is my search:
index="vmware-perf" sourcetype="vmware:perf:cpu" hypervisor_id="*"
| join hypervisor_id [search index="vmware-inv" sourcetype="vmware:inv:hostsystem"]
| timechart avg(cpu_load_percent) by hypervisor_name

my Problem:
This search will list all hosts.
But, i would like to have an evaluation of the top 5 hosts.
The idea was to calculate the sum of average values from one host over a period of time.
Then i compare this result with the other hosts and could sort a top 5 list...

Does anyone have an idea how to modify the search?

Re: show top 5 CPU Usage vom VMware Hosts

woodcock — Sun, 13 Oct 2019 23:34:07 GMT

Never use join; try this:

(index="vmware-perf" sourcetype="vmware:perf:cpu" hypervisor_id="*") OR
(index="vmware-inv" sourcetype="vmware:inv:hostsystem")
| eventstats values(hypervisor_name) AS hypervisor_name BY hypervisor_id
| timechart avg(cpu_load_percent) AS avg_cpu_load_pct BY hypervisor_name
| untable _time hypervisor_name avg_cpu_load_pct
| eventstats sum(avg_cpu_load_pct) AS sum_for_top5 BY hypervisor_name
| sort 0 - sum_for_top5 hypervisor_name
| streamstats current=f last(hypervisor_name) AS next_hypervisor_name
| streamstats count(eval(hypervisor_name!=next_hypervisor_name)) AS count
| where count<5
| timechart limit=0 useother=f avg(avg_cpu_load_pct) AS avg_cpu_load_pct BY hypervisor_name

Re: show top 5 CPU Usage vom VMware Hosts

Prewin027 — Wed, 30 Sep 2020 02:32:09 GMT

Hi,

You can use below search.

index="vmware-perf" sourcetype="vmware:perf:cpu" hypervisor_id="*"
| join hypervisor_id [search index="vmware-inv" sourcetype="vmware:inv:hostsystem"]
| timechart avg(cpu_load_percent) by hypervisor_name

modify the same to

Re: show top 5 CPU Usage vom VMware Hosts

pduvofmr — Mon, 14 Oct 2019 07:31:21 GMT

Hi,

ther is no list of hosts...

Re: show top 5 CPU Usage vom VMware Hosts

pduvofmr — Mon, 14 Oct 2019 09:27:25 GMT

Hi,

works, but it dont sort the host list vom maximum to minimum load.
Can you helm me again?

thx

Re: show top 5 CPU Usage vom VMware Hosts

pduvofmr — Mon, 14 Oct 2019 09:31:17 GMT

Correction:

there is a host list, was a performance problem, sorry, dev center 😉
Now, how to sort hosts to display from maximum to minimum load?

thx

Re: show top 5 CPU Usage vom VMware Hosts

pduvofmr — Mon, 14 Oct 2019 11:58:58 GMT

Quote: Never use join

Why, please explain - thx

Re: show top 5 CPU Usage vom VMware Hosts

woodcock — Mon, 14 Oct 2019 12:51:08 GMT

I assumed that hypervisor_name was your "host" field. Are there multiple hosts per hypervisor or multiple hypervisor per host? Answer that and I will try again.

Re: show top 5 CPU Usage vom VMware Hosts

woodcock — Mon, 14 Oct 2019 12:51:55 GMT

Just Google it. This has been widely opined. It does not scale.

Re: show top 5 CPU Usage vom VMware Hosts

pduvofmr — Mon, 14 Oct 2019 13:03:17 GMT

host = ESX Server
supervisor = ???

actualy the top5 ESX server where sorted alphabetically, not by load

Re: show top 5 CPU Usage vom VMware Hosts

pduvofmr — Mon, 14 Oct 2019 13:09:37 GMT

the problem is that the graph shows zero until the evaluation is complete. (10-30 seconds)

With join the graph builds up ...

Re: show top 5 CPU Usage vom VMware Hosts

woodcock — Mon, 14 Oct 2019 14:54:14 GMT

But it will be lacking events and showing incorrect results.

Re: show top 5 CPU Usage vom VMware Hosts

woodcock — Mon, 14 Oct 2019 14:55:00 GMT

Stupid autocorrect. I should have said "hypervisor", not "supervisor".