https://community.splunk.com/t5/Splunk-Search/How-can-i-get-cpu-time-for-each-component-in-log-files/m-p/123141#M184190 <P>Hi <BR /> Try this search code</P> <PRE><CODE> index="_internal" source="*metrics.log" group="pipeline" | chart sum(cpu_seconds) over processor | sort -sum(cpu_seconds) |rename sum(cpu_seconds) as "Total CPU Seconds" </CODE></PRE> Mon, 06 Apr 2015 12:25:53 GMT chimell 2015-04-06T12:25:53Z https://community.splunk.com/t5/Splunk-Search/How-can-i-get-cpu-time-for-each-component-in-log-files/m-p/123138#M184187 <P>Hai</P> <PRE><CODE> i have some installation logfiles and i want to caluculate cpu time for each components(success and falied cases)... </CODE></PRE> Mon, 06 Apr 2015 09:42:29 GMT https://community.splunk.com/t5/Splunk-Search/How-can-i-get-cpu-time-for-each-component-in-log-files/m-p/123138#M184187 vasavigangana 2015-04-06T09:42:29Z https://community.splunk.com/t5/Splunk-Search/How-can-i-get-cpu-time-for-each-component-in-log-files/m-p/123139#M184188 <P>Hi,<BR /> Here is the search code:</P> <PRE><CODE>index=_internal status=failure OR status=success | timechart c by status </CODE></PRE> Mon, 06 Apr 2015 10:04:11 GMT https://community.splunk.com/t5/Splunk-Search/How-can-i-get-cpu-time-for-each-component-in-log-files/m-p/123139#M184188 NOUMSSI 2015-04-06T10:04:11Z https://community.splunk.com/t5/Splunk-Search/How-can-i-get-cpu-time-for-each-component-in-log-files/m-p/123140#M184189 <P>try like this:<BR /> index=_internal status=failure OR status=success |stats values(status) as status by _time</P> <P>to have time of differents status .</P> Mon, 06 Apr 2015 11:04:27 GMT https://community.splunk.com/t5/Splunk-Search/How-can-i-get-cpu-time-for-each-component-in-log-files/m-p/123140#M184189 fdi01 2015-04-06T11:04:27Z https://community.splunk.com/t5/Splunk-Search/How-can-i-get-cpu-time-for-each-component-in-log-files/m-p/123141#M184190 <P>Hi <BR /> Try this search code</P> <PRE><CODE> index="_internal" source="*metrics.log" group="pipeline" | chart sum(cpu_seconds) over processor | sort -sum(cpu_seconds) |rename sum(cpu_seconds) as "Total CPU Seconds" </CODE></PRE> Mon, 06 Apr 2015 12:25:53 GMT https://community.splunk.com/t5/Splunk-Search/How-can-i-get-cpu-time-for-each-component-in-log-files/m-p/123141#M184190 chimell 2015-04-06T12:25:53Z