topic Re: Calculating the disk read write ratio in Splunk Search

Calculating the disk read write ratio

shabdadev — Wed, 22 Feb 2017 12:18:32 GMT

I have this below query . After the summation of values is calculated , i have to find the ratio of read versus write and have to modify this query only for that . How to do it?

index=nmon host=* type=DISKWRITE OR type=DISKREAD | stats sum(value) by type

Re: Calculating the disk read write ratio

Richfez — Wed, 22 Feb 2017 12:42:14 GMT

Possibly solvable without this, but it would be easier and quicker (with far fewer false starts, probably) if we had a few of the original events to look at.

Re: Calculating the disk read write ratio

shabdadev — Wed, 22 Feb 2017 13:04:07 GMT

I cant provide the events . can you please provide the solution to this ......each event of diskread has a value and same is the case with diskwrite . I have to find the disk read write ratio .

Re: Calculating the disk read write ratio

pradeepkumarg — Wed, 22 Feb 2017 14:58:01 GMT

You can try something like this

index=nmon host=* type=DISKWRITE OR type=DISKREAD | stats sum(value) as value by type | eventstats sum(value) as total | head 1 | eval ratio = value/total

Re: Calculating the disk read write ratio

shabdadev — Thu, 23 Feb 2017 05:36:41 GMT

See till here
index=nmon host=* type=DISKWRITE OR type=DISKREAD | stats sum(value) as value by type

query returns the output like this :

type sum(value)

diskread 2.3445

diskwrite 3.56666

Aftert this i want to compute the ratio of read versus write i.e diskread / diskwrite

how to do this one?

Re: Calculating the disk read write ratio

DalJeanis — Thu, 23 Feb 2017 06:00:59 GMT

try this

index=nmon host=* type=DISKWRITE OR type=DISKREAD 
| eval WriteValue=if(type="DISKWRITE", value,0)
| eval ReadValue=if(type="DISKREAD", value,0)
| stats count, sum(ReadValue) as ReadValue, sum(WriteValue) as WriteValue,  sum(value) as TotalValue
| eval ReadPercent=ReadValue/TotalValue
| eval WritePercent=WriteValue/TotalValue,
| eval ReadRatio=ReadValue/If(WriteValue==0,0.01,WriteValue)
| table count, ReadValue, ReadPercent, WriteValue, WritePercent, ReadRatio

It calculates a few extra things so you can check the results. After you've verified it, you can remove anything you don't want to see.

Re: Calculating the disk read write ratio

shabdadev — Thu, 23 Feb 2017 06:12:36 GMT

Thanks a lot 🙂 .it worked

Re: Calculating the disk read write ratio

Honey0308 — Thu, 23 Feb 2017 08:07:40 GMT

Try the following.

index=nmon host=* type=DISKWRITE OR type=DISKREAD
| stats sum(eval(type=DISKWRITE)) AS DiskWriteSum, sum(eval(type=DISKREAD)) AS DiskReadSum
| eval Ratio = round((DiskWriteSum/DiskReadSum),2)

You can omit the rounding off, if required. Hope this works fine.

Re: Calculating the disk read write ratio

DalJeanis — Thu, 23 Feb 2017 18:51:45 GMT

You are quite welcome. Please accept one of the helpful answers. gpradeepkumarreddy's is fine - it got you pretty much there.