https://community.splunk.com/t5/Splunk-Search/It-is-possible-to-use-a-variable-under-mstats-search/m-p/657526#M227117 <P>Your a real legend&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367">@bowesmana</a>&nbsp;. I didn't realize that you can put wildcards in the middle. Thank you so much for your help. I am new to Splunk so your help is really helpful.&nbsp;</P> Thu, 14 Sep 2023 05:09:25 GMT soulmaker 2023-09-14T05:09:25Z https://community.splunk.com/t5/Splunk-Search/It-is-possible-to-use-a-variable-under-mstats-search/m-p/657523#M227115 <P>Hi there,&nbsp;</P><P>I am trying to make a statistic graph in my dashboard using the search below.&nbsp;&nbsp;</P><LI-CODE lang="markup">| mstats rate(vault.runtime.total_gc_pause_ns.value) as gc_pause WHERE `vault_telemetry` AND cluster=* AND (host=*) BY host span=5m | timechart max(gc_pause) AS iowait bins=1000 BY host | eval warning=3.3e7, critical=8.3e7</LI-CODE><P>**Note that the search below comes from the pre-defined dashboard template but it is not working as is in my environment.&nbsp;<BR /><BR />In my Splunk, when I do a mpreview of my index `vault_telemetry` I am getting a result like the below:<BR /><BR />metric_name:vault.<STRONG>hostname1</STRONG>.runtime.total_gc_pause_ns<BR />metric_name:vault.<STRONG>hostname2</STRONG>.runtime.total_gc_pause_ns<BR />metric_name:vault.<STRONG>hostname3</STRONG>.runtime.total_gc_pause_ns<BR />metric_name:vault.<STRONG>hostname3</STRONG>.runtime.total_gc_pause_ns<BR />metric_name:vault.<STRONG>hostname4</STRONG>.runtime.total_gc_pause_ns<BR /><BR /></P><P>If I modify the pre-defined search from the template using the below I can get the result however, I can only do it on one hostname.&nbsp;</P><LI-CODE lang="markup">| mstats rate(vault.hostname1.runtime.total_gc_pause_ns) as gc_pause WHERE `vault_telemetry` span=5m | timechart max(gc_pause) AS iowait bins=1000 | eval warning=3.3e7, critical=8.3e7</LI-CODE><P>&nbsp;</P><P>I would like to have all the hostname shows on my single panel. Can someone please able to assist and help me with the correct search index I need to use?</P> Thu, 14 Sep 2023 04:11:25 GMT https://community.splunk.com/t5/Splunk-Search/It-is-possible-to-use-a-variable-under-mstats-search/m-p/657523#M227115 soulmaker 2023-09-14T04:11:25Z https://community.splunk.com/t5/Splunk-Search/It-is-possible-to-use-a-variable-under-mstats-search/m-p/657524#M227116 <P>If I understood correctly, just use wildcards</P><LI-CODE lang="markup">| mstats rate(vault.hostname*.runtime.total_gc_pause_ns) as gc_pause_* WHERE `vault_telemetry` span=5m | timechart max(gc_pause_*) AS iowait_* bins=1000 | eval warning=3.3e7, critical=8.3e7</LI-CODE><P>&nbsp;</P> Thu, 14 Sep 2023 04:18:38 GMT https://community.splunk.com/t5/Splunk-Search/It-is-possible-to-use-a-variable-under-mstats-search/m-p/657524#M227116 bowesmana 2023-09-14T04:18:38Z https://community.splunk.com/t5/Splunk-Search/It-is-possible-to-use-a-variable-under-mstats-search/m-p/657526#M227117 <P>Your a real legend&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367">@bowesmana</a>&nbsp;. I didn't realize that you can put wildcards in the middle. Thank you so much for your help. I am new to Splunk so your help is really helpful.&nbsp;</P> Thu, 14 Sep 2023 05:09:25 GMT https://community.splunk.com/t5/Splunk-Search/It-is-possible-to-use-a-variable-under-mstats-search/m-p/657526#M227117 soulmaker 2023-09-14T05:09:25Z