topic help on eval command in Splunk Search

help on eval command

jip31 — Wed, 30 Sep 2020 04:08:04 GMT

I use the search below which works fine
as you can see i count hte number of hosts corresponding to a process_cpu_used_percent scale (0-20, 20-40, 40-60....)
but what I need is to have an average of process_cpu_used_percent in order to identify the number of host which are in a average scale of 0-20, 20-40, 40-60...
I tried something like this but it doenst works

eval(case(avg(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",


 `CPU` 
    | fields process_cpu_used_percent host 
    | eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
        process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
        process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
        process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
        process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100") 
    | chart dc(host) as "Number" by cpu_range 
    | search cpu_range=$tok_filtercpu$ 
    | append 
        [| makeresults 
        | fields - _time 
        | eval cpu_range="0-20,20-40,40-60,60-80,80-100" 
        | makemv cpu_range delim="," 
        | mvexpand cpu_range 
        | eval "Number"=0] 
    | dedup cpu_range 
    | sort cpu_range 
    | transpose header_field=cpu_range 
    | search column!="_*" 
    | rename column as cpu_range

could you help me please??

Re: help on eval command

to4kawa — Fri, 07 Feb 2020 08:28:51 GMT

 `CPU` 
| fields process_cpu_used_percent host   
| eval cpu_range=case(process_cpu_used_percent / 20 <= 1,"0-20"
, process_cpu_used_percent / 40 <= 1,"20-40"
, process_cpu_used_percent / 60 <= 1,"40-60"
, process_cpu_used_percent / 80 <= 1,"60-80"
, process_cpu_used_percent / 100 <= 1,"80-100")
| chart dc(host) as "Number" avg(process_cpu_used_percent) as avg_cpu by cpu_range 
| search cpu_range=$tok_filtercpu$ 
| append [| makeresults 
 | fillnull "0-20","20-40","40-60","60-80","80-100" 
 | fields - _* 
 | transpose 0 column_name=cpu_range 
 | rename "row 1" as Number
 | eval avg_cpu = 0] 
| dedup cpu_range 
| sort cpu_range 
| transpose 0 header_field=cpu_range column_name=cpu_range

how about this?

Re: help on eval command

jip31 — Fri, 07 Feb 2020 09:56:48 GMT

Not really
on x axis, I have 2 value (number & avg_cpu) and if i have a look to the original barchart
if it can help, i send you the xml in pj

Re: help on eval command

to4kawa — Fri, 07 Feb 2020 10:53:20 GMT

Sample:

| makeresults count=15 
| eval host="host_".(random() % 4), process_cpu_used_percent=random() % 100 
| table process_cpu_used_percent host 
| fields process_cpu_used_percent host 
| eval cpu_range=case(process_cpu_used_percent / 20 <= 1,"0-20"
    , process_cpu_used_percent / 40 <= 1,"20-40"
    , process_cpu_used_percent / 60 <= 1,"40-60"
    , process_cpu_used_percent / 80 <= 1,"60-80"
    , process_cpu_used_percent / 100 <= 1,"80-100") 
| chart dc(host) as "Number" avg(process_cpu_used_percent) as avg_cpu by cpu_range 
| append 
    [| makeresults 
    | fillnull "0-20","20-40","40-60","60-80","80-100" 
    | fields - _* 
    | transpose 0 column_name=cpu_range 
    | rename "row 1" as Number 
    | eval avg_cpu = 0] 
| dedup cpu_range 
| sort cpu_range 
| transpose 0 header_field=cpu_range column_name=cpu_range

Result:

cpu_range   0-20    20-40   40-60   60-80   80-100
Number  0   2   2   3   2
avg_cpu 0   36.5    48.4    68.16666666666667   94