topic Re: Resource monitoring in Splunk Search

Resource monitoring: Why am i only getting timestamps but no other value?

denipon — Fri, 18 Aug 2023 17:43:02 GMT

Hello friends,

I'm fairly new to Splunk, so please bear with me here.

I have the output of the sar -u command on a solaris server. in the format:

Timestamp

%usr

%sys

%wio

%idle

%cpu

now i was able to create a line graph outputting all five values, but as soon as i take away even one of the categories, i only get timestamps but no other value. how can i specifically search to output only the cpu value as average in either a bar chart or filler gauge?

Thanks for reading.

Best,

Denipon

Re: Resource monitoring

isoutamo — Thu, 10 Aug 2023 08:39:43 GMT

can you post your sample data and what you have on your query? Please use </> tag when you add those here!

r. Ismo

Re: Resource monitoring

denipon — Thu, 17 Aug 2023 01:01:38 GMT

Sorry for the absolutely overwhelmingly late response.

So the logs are just the standard "sar" command logs from solaris, displaying "usr", "sys", "wio", "idle", "cpu".

in events they show up like this "Average 15 24 0 45 55"

And for the love of all that is good, I can't figure out how to structure my search query, to only display one of these values...

currently my search query which i was able to display all five values with is this:

Average index="name_of_index" sourcetype="name_of_source" | timechart avg(usr) avg(sys) avg(wio) avg(idle) avg(cpu) span=id

Any help is much appreciated.

Re: Resource monitoring

isoutamo — Fri, 18 Aug 2023 08:10:35 GMT

This should work

index="name_of_index" sourcetype="name_of_source" | timechart span=<time span like 15m> avg(usr) avg(sys) avg(wio) avg(idle) avg(cpu) by host

with this you could add/remove those avg(xyz) from time chart. If you don' t add span=15m then time chart use span based on your search time slot.

Re: Resource monitoring

denipon — Fri, 18 Aug 2023 08:39:13 GMT

Thanks a lot.

Seems to have done the trick.

Hope you have a wonderful weekend ahead of you.