Hello !
Right, could you give more details about the selection you have done within the interface ? Have you selected any time filtering ?
Maybe there is a mistake somewhere in the User Interface that would explain this, giving me the detail of your selection will help.
Between this, please have a look on the How interface provided within the App (Howto menu in the app bar), you will find a dedicated dashboard that provides SPL search samples.
HOWTO LPAR: Generate stats and charts with Splunk Search Processing Language (SPL) for IBM Pseries Pools
If i well understand what you want to get, you can do things like:
Global stats over the period, result in a table stats
eventtype=nmon:performance type=LPAR host=<myserver> PoolIdle>0
| eval usage=round((poolCPUs-PoolIdle),2)
| eval Pool_id=if(isnull(Pool_id), "0", Pool_id)
| stats min(usage) AS "Min Pool CPU usage", avg(usage) AS "Avg Pool CPU usage", max(usage) AS "Max Pool CPU usage" by frameID,Pool_id,hostname
| eval "Avg Pool CPU usage"=round('Avg Pool CPU usage', 2) | sort frameID,Pool_id,hostname
Per day stats over the period, result in a table stats (adding a | bucket _time span=1d and the _time in the by statement)
eventtype=nmon:performance type=LPAR host=<myserver> PoolIdle>0
| eval usage=round((poolCPUs-PoolIdle),2)
| eval Pool_id=if(isnull(Pool_id), "0", Pool_id)
| bucket _time span=1d
| stats min(usage) AS "Min Pool CPU usage", avg(usage) AS "Avg Pool CPU usage", max(usage) AS "Max Pool CPU usage" by _time, frameID,Pool_id,hostname
| eval "Avg Pool CPU usage"=round('Avg Pool CPU usage', 2) | sort frameID,Pool_id,hostname
You can also use timechart, or chart if the final result wanted is charting instead of table stats. (see examples in the Howto)
Note that you can also use the provided Pivot data model, open the model available in the Pivot menu within the app bar.
