Archive
Highlighted

UNIX CPU data extraction for multiple hosts

New Member

Hello,
Am trying to extract UNIX CPU data core wise for multiple hosts, Am using the below query for extract,

source=cpu host="XYZ"
| multikv fields CPU pctIdle
| eval PercentCPULoad = 100 - pctIdle
| timechart span=5m eval(round(avg(PercentCPULoad),0)) by CPU
| table time all *
| eval _time=strftime(
time,"%m/%d/%Y %H:%M:%S")
| table _time all *

however this looses the host field after the timechart command and am not able to view name of the host in the table.

"_time",all,0,1,2,3,4,5,6,7
"08/14/2019 14:35:00",3,3,4,4,5,3,2,3,2
"08/14/2019 14:40:00",5,5,7,6,5,5,4,5,4
"08/14/2019 14:45:00",4,4,4,5,5,4,4,3,4
"08/14/2019 14:50:00",2,2,1,2,2,2,5,4,1

I also tried with the bucket and stats command which gives the host field (query as below) but, it changes the format.

index=main host="XYZ" source=cpu
| multikv fields pctIdle host CPU
| eval PercentCPULoad = 100 - pctIdle
| table time host CPU PercentCPULoad
| bucket _time span=5m
| stats avg(Percent
CPU_Load) by _time,CPU,host

"time",CPU,host,"avg(PercentCPU_Load)"
"2019-08-13T14:00:00.000-0400",0,"XYZ","1.9040000000000006"
"2019-08-13T14:00:00.000-0400",1,"XYZ","2.8860000000000015"
"2019-08-13T14:00:00.000-0400",2,"XYZ","2.1960000000000006"
"2019-08-13T14:00:00.000-0400",3,"XYZ","2.7099999999999995"
"2019-08-13T14:00:00.000-0400",4,"XYZ","2.5839999999999987"
"2019-08-13T14:00:00.000-0400",5,"XYZ","2.595"
"2019-08-13T14:00:00.000-0400",6,"XYZ","2.1990000000000007"
"2019-08-13T14:00:00.000-0400",7,"XYZ","2.093000000000001"

Am also unable to use an eval command and add a host field, Because the query is for an extract and I might need to add multiple hosts.
So please could some one help me with an extract in the below format

_time, Host, all,0,1,2,3,4,5,6,7

Tags (1)
0 Karma
Highlighted

Re: UNIX CPU data extraction for multiple hosts

Champion

what happens if inyour first code, you just tinker with the timechart a bit

| timechart span=5m eval(round(avg(Percent_CPU_Load),0)) ,values(host) by CPU
0 Karma
Highlighted

Re: UNIX CPU data extraction for multiple hosts

New Member

Hi sukisen,
Timechart command is not taking a second argument, so it errors out. Any other ideas pls

0 Karma
Highlighted

Re: UNIX CPU data extraction for multiple hosts

Champion

hi @johnsasikumar the issue is with the renaming try this. Timechart won;t take more than 1 field AFTER the by clause , but there are no restrictions before the by clause

| timechart span=5m eval(round(avg(Percent_CPU_Load),0)) as cpu_load ,values(host) as host by CPU
0 Karma
Highlighted

Re: UNIX CPU data extraction for multiple hosts

New Member

Hi @Sukisen1981
I did try and rename, it works when I give one host. But it doesn’t work for multiple hosts.
When I add an additional host it doesn’t work

0 Karma
Highlighted

Re: UNIX CPU data extraction for multiple hosts

Champion

in your first code having the timechart, what if you also extract the host using multikv?
source=cpu host="XYZ"
| multikv fields CPU pctIdle host

and then apply the timechart with rename?

0 Karma
Highlighted

Re: UNIX CPU data extraction for multiple hosts

New Member

Hi Sukisen,
Timechart command doesn’t accept a second argument. So it’s throwing an error.

0 Karma