topic Re: Finding additional info about a value returned by max in Splunk Search

Finding additional info about a value returned by max

cphair — Thu, 08 Mar 2012 19:05:11 GMT

I am looking at maximum processor usage by specific processes on a group of clients. By using stats max on my data (which contains host, instance, and % Processor Time fields), I can pull the max % Processor time that a given process reached on any client in the group. Is there a way to get Splunk to tell me which host (or record) that maximum came from? Ideally I'd like to be able to mouse over the entry in a bar graph and have it tell me something like "iexplore: 99%, host: foo1".

Re: Finding additional info about a value returned by max

Stephen_Sorkin — Fri, 09 Mar 2012 03:04:35 GMT

Yes, you can do this using the "sort" command, supposing the processor time is in a field called % Processor Time:

... | sort - "% Processor Time" | head 1 | table host instance "% Processor Time"

Now, you can make this more interesting by looking at the top per host:

... | dedup host sortby - "% Processor Time" | table host instance "% Processor Time"

Re: Finding additional info about a value returned by max

cphair — Mon, 12 Mar 2012 17:34:01 GMT

I ended up doing this another way, but I think this works too, so I'll mark it up. Thanks.

Re: Finding additional info about a value returned by max

richprescott — Wed, 06 Jun 2012 23:01:07 GMT

What was the other way that you ended up using?

Re: Finding additional info about a value returned by max

cphair — Thu, 07 Jun 2012 12:28:46 GMT

I used stats to split out the max by each host and instance, then used eval to create a new field (eval hostInstance = instance . ":" . host), then displayed the max value with the conjoined field. Inelegant but functional.

I think this is the way to go, though:



...| stats max(Value) as Max by instance,host | dedup instance sortby -Max

Still have to mess with numbered instances and case-sensitivity, but it's less ugly. Also, if you want to keep the top X readings per instance instead of the top 1, you can say "dedup X instance sortby -Max".