All Apps and Add-ons

Relative time search and plotting in a timechart

hactl2019
New Member

I currently have a search query to calculate the maximum, average and median CPU usage of a server over the past 2 hours using NMON data models, which is in real-time.

| tstats `CPU_ALL(max)` from datamodel=NMON_Data_CPU where (nodename = CPU.CPU_ALL) (host=myhost) (CPU.frameID="*") (CPU.OStype="*") `No_Filter(CPU)` groupby _time, host prestats=true span=1m
| stats dedup_splitvals=t max("CPU.cpu_PCT") AS CPU.cpu_PCT by _time, host
| fields *
| sort +str(host)
| stats max("CPU.cpu_PCT") AS max, avg("CPU.cpu_PCT") AS avg, median("CPU.cpu_PCT") AS median by host 
| eval max=round(max,2) | eval avg=round(avg,2)
| rename max as "Max (%)", avg as "Avg (%)", median as "Min (%)"

I would like to plot a timechart showing the values within the last 2 hours, where the values are the avg, max, median CPU usage within the past 2 hours relative to the timestamp.

i.e.

Assuming current time is 07:00, I would like my timechart to show the following values as a line chart:

avg, max, median CPU usage at 05:00 --> showing avg, max, median of CPU usage from 03:00 - 05:00
avg, max, median CPU usage at 05:01 --> showing avg, max, median of CPU usage from 03:01 - 05:01
avg, max, median CPU usage at 05:02 --> showing avg, max, median of CPU usage from 03:02 - 05:02
:
:
avg, max, median CPU usage at 06:59 --> showing avg, max, median of CPU usage from 04:59 - 06:59
avg, max, median CPU usage at 07:00 --> showing avg, max, median of CPU usage from 05:00 - 07:00

Are there ways to do that? Thanks in advance.

0 Karma

vishaltaneja070
Motivator

@hactl2019

why you are not using timechart?

like
| timechart span=1min max("CPU.cpu_PCT") AS max, avg("CPU.cpu_PCT") AS avg, median("CPU.cpu_PCT") AS median by host

0 Karma

hactl2019
New Member

That will give me the max, avg and median for that minute only. I found a workaround for the problem usig eval calculating the offset. Thanks anyways.

0 Karma

pandamasque
New Member

Hello, I'm having the exact same issue, but i want to have a 10-minute window. I am struggling to do it, can you share your solution?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...