topic Re: Does stats understand the % symbol? in Splunk Search

Does stats understand the % symbol?

mathewboarman — Mon, 28 Sep 2020 17:02:35 GMT

Hi,
My events actually report CPU and Mem utilization... 35.45% and 25.56%
I extract these over time but I don't get Lines on my chart.
I'm wondering if these fields are read as text... so cant be graphed?
My search is below

CSCOacs_System_Statistics host="bob" | stats list(SysStatsUtilizationMemory) as MemUtil list(SysStatsUtilizationCpu) as CPU_Util by _time

I'm wondering if I need to strip out the % from the results... or if I should be using a different tool... timechart or something.

thanks

Re: Does stats understand the % symbol?

somesoni2 — Fri, 11 Jul 2014 12:54:14 GMT

You would need numerical data for displaying charts, be it using stats, chart, timechart or any other statistical command. I would suggest something like this:

CSCOacs_System_Statistics host="bob" | replace *% with * in SysStatsUtilizationMemory,SysStatsUtilizationCpu| stats list(SysStatsUtilizationMemory) as "MemUtil%" list(SysStatsUtilizationCpu) as "CPU_Util%" by _time

Adding "%" to the labels will show % sign before the value (not same but close).

Update

Give this a try

CSCOacs_System_Statistics host="bob" | replace *% with * in SysStatsUtilizationMemory,SysStatsUtilizationCpu| chart list(SysStatsUtilizationMemory) as "MemUtil%" list(SysStatsUtilizationCpu) as "CPU_Util%" over _time by host

Re: Does stats understand the % symbol?

mathewboarman — Fri, 11 Jul 2014 12:56:48 GMT

perfect, thank you

Re: Does stats understand the % symbol?

jimodonald — Fri, 11 Jul 2014 12:59:34 GMT

I think you'd want to strip the percent signs out.

and if you're building chart, try using the chart or timechart instead of stats. Stats will still work, but it's easy to get carried away with the by clauses.

And I'd recommend you change the "list" to "avg" in order to assure you're only getting a single datapoint per time. Multiple data points per time don't graph.

so you'd end up with something like these (which are identical in output).

| chart avg(SysStatsUtilizationMemory) as MemUtil avg(SysStatsUtilizationCpu) as CPU_Util over _time

-or-

| timechart avg(SysStatsUtilizationMemory) as MemUtil avg(SysStatsUtilizationCpu) as CPU_Util

Re: Does stats understand the % symbol?

mathewboarman — Mon, 28 Sep 2020 17:02:38 GMT

... and is it possible to include the host in the label...

ie ... as $host_CPU_Util% by time

many thanks

Re: Does stats understand the % symbol?

somesoni2 — Fri, 11 Jul 2014 13:39:24 GMT

Try the updated answer. I believe the output series will be like "CPU_Util%:hostName".