topic Re: Need help on timechart with value in Splunk Search

Need help on timechart with value

jackin — Wed, 03 Nov 2021 08:01:55 GMT

Hi,

Here's my query -

| mstats max(_value) avg(_value) min(_value) prestats=true WHERE metric_name="cpu.system" AND"index"="osnixperf" AND 
[| inputlookup Unix.csv] BY host span=1h 
| stats Avg(_value) AS Avg1 BY host 
| join 
[| mstats max(_value) avg(_value) min(_value) prestats=true WHERE metric_name="cpu.user" AND"index"="osnixperf" AND 
[| inputlookup Unix.csv] BY host span=1h 
| stats Avg(_value) AS Avg2 BY host] 
| eval totalavg=Avg1+Avg2,totalavg=round(totalavg,2)

I need the timechart that shows with totalavg value like below image.

jackin_0-1635926340469.png

Re: Need help on timechart with value

ITWhisperer — Wed, 03 Nov 2021 08:10:41 GMT

Your stats commands are removing the time element from your results - try something like this

| mstats max(_value) avg(_value) AS Avg1 min(_value) prestats=true WHERE metric_name="cpu.system" AND"index"="osnixperf" AND [| inputlookup Unix.csv] BY host span=1h | join [| mstats max(_value) avg(_value) AS Avg2 min(_value) prestats=true WHERE metric_name="cpu.user" AND"index"="osnixperf" AND [| inputlookup Unix.csv] BY host span=1h | eval totalavg=Avg1+Avg2,totalavg=round(totalavg,2)

Re: Need help on timechart with value

jackin — Wed, 03 Nov 2021 08:37:52 GMT

@ITWhisperer Hi,

Its looks as working but but it not showing any values and error msg's
can you give me any suggestions to my query OR can you help any different way to calculate the 2 metrics.

Re: Need help on timechart with value

ITWhisperer — Wed, 03 Nov 2021 08:44:25 GMT

OK start with the first mstats - does this give you what you expect from just that index?

Then try the second mstats separately - does this give you what you expect from just that index?