topic how to use UNION for 4 counter types in Splunk Search

how to use UNION for 4 counter types

sunnyparmar — Tue, 23 Jun 2015 07:18:02 GMT

Hi,

I have 4 counters with the following name for the performance monitor of the system-

1.) Avg. Disk sec/Read
2.) Avg. Disk sec/Write
3.) Disk Reads/sec
4.) Disk Writes/sec

I want to see all above counters in one query in either bars or graphs so for that I am making my query like given below but it is not working. Kindly suggest where I am doing wrong?

|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host] [search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] [search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

Thanks
Ankit

Re: how to use UNION for 4 counter types

vinitatsky — Tue, 23 Jun 2015 08:17:23 GMT

Can you try 'append' and check if it works.
|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ append search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host] [ append search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] [ append search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

Re: how to use UNION for 4 counter types

vinitatsky — Tue, 23 Jun 2015 08:17:52 GMT

Just append and not append

Re: how to use UNION for 4 counter types

sunnyparmar — Tue, 23 Jun 2015 08:22:57 GMT

Thanks for the reply..I have tried but it is giving below error ..

Error in 'append' command: The last argument must be a subsearch.

Re: how to use UNION for 4 counter types

vinitatsky — Tue, 23 Jun 2015 08:28:19 GMT

Can you try - remove 'union' and use 'append'.

Re: how to use UNION for 4 counter types

sunnyparmar — Tue, 23 Jun 2015 08:33:12 GMT

After removing of union is it the right format for the command given below?

[append search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ append search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]
[append search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] [append search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

Re: how to use UNION for 4 counter types

vinitatsky — Tue, 23 Jun 2015 08:44:41 GMT

[search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] append [search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]
append [search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] append [search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

Re: how to use UNION for 4 counter types

sunnyparmar — Tue, 23 Jun 2015 09:05:26 GMT

Thanks for replying but it is showing no result found 😞

Re: how to use UNION for 4 counter types

sunnyparmar — Tue, 23 Jun 2015 09:07:52 GMT

When I am running these counters in separate queries then it is showing result. Queries are -

1.) index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) host=BWIN7136 | timechart avg(Value) by counter

2.) index=sc-perfmon (counter="Disk Reads/sec" OR counter="Disk Writes/sec" ) host=BWIN7136 | timechart avg(Value) by counter

Re: how to use UNION for 4 counter types

vinitatsky — Tue, 23 Jun 2015 09:16:18 GMT

Sorry. My mistake. Can you please try using appendcols, instead of append and I hope it works.

Re: how to use UNION for 4 counter types

sunnyparmar — Tue, 23 Jun 2015 09:54:18 GMT

still showing the same result (no result found)..

Re: how to use UNION for 4 counter types

vinitatsky — Tue, 23 Jun 2015 11:06:39 GMT

index=sc-perfmon counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" OR counter="Disk Reads/sec" OR counter="Disk Writes/sec" | chart avg(Value) over _time by counter

Re: how to use UNION for 4 counter types

sunnyparmar — Tue, 23 Jun 2015 11:15:49 GMT

it works.. thanks a lot...