https://community.splunk.com/t5/Splunk-Search/How-to-create-search-for-CPU-linux-to-load-average/m-p/590500#M205589 <P>Hi ,</P> <P>I need the help to write splunk query for calculating CPU Linux load average for last 1,5 and 15 mins. I have splunk TA nix app and collected the metrics&nbsp;<SPAN><STRONG>vmstat_metric.loadAvg1mi</STRONG>&nbsp;and used this metrics&nbsp; for last 1 min query.&nbsp; But I am not sure how to calculate the load average for last 5 and 15 mins. can anyone&nbsp;</SPAN></P> <P>&nbsp;</P> Wed, 23 Mar 2022 22:05:49 GMT mm12 2022-03-23T22:05:49Z https://community.splunk.com/t5/Splunk-Search/How-to-create-search-for-CPU-linux-to-load-average/m-p/590500#M205589 <P>Hi ,</P> <P>I need the help to write splunk query for calculating CPU Linux load average for last 1,5 and 15 mins. I have splunk TA nix app and collected the metrics&nbsp;<SPAN><STRONG>vmstat_metric.loadAvg1mi</STRONG>&nbsp;and used this metrics&nbsp; for last 1 min query.&nbsp; But I am not sure how to calculate the load average for last 5 and 15 mins. can anyone&nbsp;</SPAN></P> <P>&nbsp;</P> Wed, 23 Mar 2022 22:05:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-search-for-CPU-linux-to-load-average/m-p/590500#M205589 mm12 2022-03-23T22:05:49Z https://community.splunk.com/t5/Splunk-Search/How-to-create-search-for-CPU-linux-to-load-average/m-p/590611#M205633 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/238710">@mm12</a>,</P><P>you have to categorize your data, using eval, something like this:</P><LI-CODE lang="markup">your_search | eval period=case(_time&lt;60,"1",_time&lt;300,"2",_time&lt;1500,"3") | stats avg(eval(if(_time&lt;60,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_1m avg(eval(if(_time&lt;300,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_5m avg(eval(if(_time&lt;1500,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_15m</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Thu, 24 Mar 2022 08:22:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-search-for-CPU-linux-to-load-average/m-p/590611#M205633 gcusello 2022-03-24T08:22:15Z