topic Re: UNIX CPU data extraction for multiple hosts in Splunk Search

UNIX CPU data extraction for multiple hosts

johnsasikumar — Wed, 30 Sep 2020 01:44:16 GMT

Hello,
Am trying to extract UNIX CPU data core wise for multiple hosts, Am using the below query for extract,

however this looses the host field after the timechart command and am not able to view name of the host in the table.

"_time",all,0,1,2,3,4,5,6,7
"08/14/2019 14:35:00",3,3,4,4,5,3,2,3,2
"08/14/2019 14:40:00",5,5,7,6,5,5,4,5,4
"08/14/2019 14:45:00",4,4,4,5,5,4,4,3,4
"08/14/2019 14:50:00",2,2,1,2,2,2,5,4,1

I also tried with the bucket and stats command which gives the host field (query as below) but, it changes the format.

"_time",CPU,host,"avg(Percent_CPU_Load)"
"2019-08-13T14:00:00.000-0400",0,"XYZ","1.9040000000000006"
"2019-08-13T14:00:00.000-0400",1,"XYZ","2.8860000000000015"
"2019-08-13T14:00:00.000-0400",2,"XYZ","2.1960000000000006"
"2019-08-13T14:00:00.000-0400",3,"XYZ","2.7099999999999995"
"2019-08-13T14:00:00.000-0400",4,"XYZ","2.5839999999999987"
"2019-08-13T14:00:00.000-0400",5,"XYZ","2.595"
"2019-08-13T14:00:00.000-0400",6,"XYZ","2.1990000000000007"
"2019-08-13T14:00:00.000-0400",7,"XYZ","2.093000000000001"

Am also unable to use an eval command and add a host field, Because the query is for an extract and I might need to add multiple hosts.
So please could some one help me with an extract in the below format

_time, Host, all,0,1,2,3,4,5,6,7

Re: UNIX CPU data extraction for multiple hosts

Sukisen1981 — Wed, 14 Aug 2019 19:25:05 GMT

what happens if inyour first code, you just tinker with the timechart a bit

| timechart span=5m eval(round(avg(Percent_CPU_Load),0)) ,values(host) by CPU

Re: UNIX CPU data extraction for multiple hosts

johnsasikumar — Thu, 15 Aug 2019 02:24:11 GMT

Hi Sukisen,
Timechart command doesn’t accept a second argument. So it’s throwing an error.

Re: UNIX CPU data extraction for multiple hosts

johnsasikumar — Thu, 15 Aug 2019 02:26:11 GMT

Hi sukisen,
Timechart command is not taking a second argument, so it errors out. Any other ideas pls

Re: UNIX CPU data extraction for multiple hosts

Sukisen1981 — Thu, 15 Aug 2019 06:04:20 GMT

hi @johnsasikumar the issue is with the renaming try this. Timechart won;t take more than 1 field AFTER the by clause , but there are no restrictions before the by clause

| timechart span=5m eval(round(avg(Percent_CPU_Load),0)) as cpu_load ,values(host) as host by CPU

Re: UNIX CPU data extraction for multiple hosts

johnsasikumar — Thu, 15 Aug 2019 08:39:28 GMT

Hi @Sukisen1981
I did try and rename, it works when I give one host. But it doesn’t work for multiple hosts.
When I add an additional host it doesn’t work

Re: UNIX CPU data extraction for multiple hosts

Sukisen1981 — Thu, 15 Aug 2019 10:07:37 GMT

in your first code having the timechart, what if you also extract the host using multikv?
source=cpu host="XYZ"
| multikv fields CPU pctIdle host

and then apply the timechart with rename?