topic How to customize x-axis and y-axis? in Splunk Search

How to customize x-axis and y-axis?

coolUsername — Thu, 25 Aug 2022 16:20:57 GMT

I want to create a chart that show all the services being executed and the percentage of cpu used.

I tried this after reading the documentation but it doesn't work.

index=perfmon ProcessName="*" | chart count(cpu_load_percent) over ProcessName

Re: How to custom x-axis and y-axis

richgalloway — Thu, 25 Aug 2022 12:27:14 GMT

Please elaborate on "it doesn't work". What results did you get and how did they not meet expectations?

Re: How to custom x-axis and y-axis

coolUsername — Thu, 25 Aug 2022 13:03:49 GMT

this is what i get when i do the search, the value of cpu_user_percent is equal to zero, which is not normal but i its because the fields are not compatibles. I apologize for my bad english

Re: How to custom x-axis and y-axis

richgalloway — Thu, 25 Aug 2022 13:49:16 GMT

First, verify you are receiving events with the cpu_load_percent field in them. That the count of the field is zero implies you do not have the data.

Second, you probably don't want the count function because the counting the number of instances of this field is not as useful as knowing the value of the field. Perhaps max(cpu_load_percent) would be better.

Re: How to custom x-axis and y-axis

coolUsername — Thu, 25 Aug 2022 13:57:06 GMT

i receive events when i do separates searchs, one with cpu_load_percent, and the other with processName, but not with both fields, and this is what i get when i dont add the count function:

Re: How to custom x-axis and y-axis

richgalloway — Thu, 25 Aug 2022 16:10:00 GMT

Before you can graph the relationship between processName and cpu_load_percent you must first establish such a relationship. The two searches that return the separate fields need to be combined so you have both fields in the results. Share the searches and we can help you put them together.

Re: How to custom x-axis and y-axis

coolUsername — Fri, 26 Aug 2022 07:28:36 GMT

search for cpu_load_percent

index=perfmon cpu_load_percent=*

search for ProcessName

index=perfmon ProcessName

Re: How to custom x-axis and y-axis

richgalloway — Fri, 26 Aug 2022 16:35:16 GMT

That's not much to work with. What links a processName to its cpu_load_percent?

Re: How to custom x-axis and y-axis

coolUsername — Mon, 29 Aug 2022 07:23:06 GMT

The variation of the cpu depends on the process running. its like when i open the windows task manager, it show the process which is running and the percentage of cpu used. I want to make a chart of all the process running and the percentage of cpu used. Hope i explained it correctly.

Re: How to custom x-axis and y-axis

richgalloway — Fri, 02 Sep 2022 11:59:59 GMT

Splunk is not looking at the Task Manager. It has two searches with two different and distinct fields and nothing to link them. Check your data to see if there are other fields that can be used to associate a processName with its cpu_load_percent.

Re: How to customize x-axis and y-axis?

coolUsername — Fri, 02 Sep 2022 07:25:17 GMT

Sorry for answering this late. I think i misexplained, i just assumed that ProcessName is related to the services running and cpu_load_percent is the percentage of cpu used. And even if they are not related, they certainly vary over time. So i want to make my chart not to be a timechart and show the two fields. Thank you in advance. Also if the fields i am using are not correct tell me