All Apps and Add-ons

Relative time search and plotting in a timechart

hactl2019
New Member

I currently have a search query to calculate the maximum, average and median CPU usage of a server over the past 2 hours using NMON data models, which is in real-time.

| tstats `CPU_ALL(max)` from datamodel=NMON_Data_CPU where (nodename = CPU.CPU_ALL) (host=myhost) (CPU.frameID="*") (CPU.OStype="*") `No_Filter(CPU)` groupby _time, host prestats=true span=1m
| stats dedup_splitvals=t max("CPU.cpu_PCT") AS CPU.cpu_PCT by _time, host
| fields *
| sort +str(host)
| stats max("CPU.cpu_PCT") AS max, avg("CPU.cpu_PCT") AS avg, median("CPU.cpu_PCT") AS median by host 
| eval max=round(max,2) | eval avg=round(avg,2)
| rename max as "Max (%)", avg as "Avg (%)", median as "Min (%)"

I would like to plot a timechart showing the values within the last 2 hours, where the values are the avg, max, median CPU usage within the past 2 hours relative to the timestamp.

i.e.

Assuming current time is 07:00, I would like my timechart to show the following values as a line chart:

avg, max, median CPU usage at 05:00 --> showing avg, max, median of CPU usage from 03:00 - 05:00
avg, max, median CPU usage at 05:01 --> showing avg, max, median of CPU usage from 03:01 - 05:01
avg, max, median CPU usage at 05:02 --> showing avg, max, median of CPU usage from 03:02 - 05:02
:
:
avg, max, median CPU usage at 06:59 --> showing avg, max, median of CPU usage from 04:59 - 06:59
avg, max, median CPU usage at 07:00 --> showing avg, max, median of CPU usage from 05:00 - 07:00

Are there ways to do that? Thanks in advance.

0 Karma

vishaltaneja070
Motivator

@hactl2019

why you are not using timechart?

like
| timechart span=1min max("CPU.cpu_PCT") AS max, avg("CPU.cpu_PCT") AS avg, median("CPU.cpu_PCT") AS median by host

0 Karma

hactl2019
New Member

That will give me the max, avg and median for that minute only. I found a workaround for the problem usig eval calculating the offset. Thanks anyways.

0 Karma

pandamasque
New Member

Hello, I'm having the exact same issue, but i want to have a 10-minute window. I am struggling to do it, can you share your solution?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...