topic How to display load average values in a chart? in Splunk Search

How to display load average values in a chart?

rajgowd1 — Thu, 19 Jan 2017 23:05:34 GMT

Hi,
i have written script which extracts the load average values and provides the output.by using below output, how can we create charts to display load average?

Re: How to display load average values in a chart?

somesoni2 — Fri, 20 Jan 2017 01:23:52 GMT

YOu may be missing the output that you wanted to show.

Re: How to display load average values in a chart?

rajgowd1 — Fri, 20 Jan 2017 01:25:03 GMT

sorry here is the output

system time="Thu Jan 19 20:24:50 2017" HostName ="gpd-653-fc88" Days ="76" Users ="2" name="loadaverage|last1min" value="0.00"/>

Re: How to display load average values in a chart?

rajgowd1 — Fri, 20 Jan 2017 01:46:35 GMT

somehow i am not able to copy entire output,i copied single line
but here is the last column from the out put

name="loadaverage|last1min" value="0.00"
name="loadaverage|last5min" value="0.34"/>
name="loadaverage|last15min" value="5.00"/>

Re: How to display load average values in a chart?

gokadroid — Fri, 20 Jan 2017 02:16:34 GMT

Since there is no time given in the sample so I will guess it. Let's say if load averages are being calculated at discrete intervals, i.e. the 15 min average does not have data included from the 5 minute average, and 5 minute average doesn't have 1 minute average in it, then if each "output" line is a single event the intuitive graph that becomes is:

index=yourIndex sourcetype=yourSourcetype loadaverage
| rex "value=\"(?<loadAvg>[^\"]+)\""
| timechart max(loadAvg) as LoadAvg

From the visualization options choose Format >> General >> Null Values as Connect to ensure the average stays continuous in case of missing values . That shall form the basic timechart at least to start off. Alternatively you can use min function in timechart.

Re: How to display load average values in a chart?

rajgowd1 — Fri, 20 Jan 2017 02:51:40 GMT

thank you for your response.

Re: How to display load average values in a chart?

rajgowd1 — Fri, 20 Jan 2017 03:10:05 GMT

can we show values in single line like below

0.00,0.20,10.00

Re: How to display load average values in a chart?

gokadroid — Fri, 20 Jan 2017 04:30:02 GMT

you might want to explore the transpose option, something like:

index=yourIndex sourcetype=yourSourcetype loadaverage
| rex "value=\"(?<loadAvg>[^\"]+)\""
| table loadAvg
| transpose