hello
i try to use the code below but everytimes i have an issue of quote or parenthesis even if i do modifications:
| timechart span=10m eval(avg(if host=="$field1$",PercentProcessorTime,NULL)) as PercentProcessorTime_AVG by host
OR eval(avg(if host=="$field2$",PercentProcessorTime,NULL)) as PercentProcessorTime_AVG by host
could you help me please
Hi @jip31 ,
If you want to do a timechart based on host, you could simply do it by
index="windows-wmi" sourcetype="WMI:CPUload" host="$field1$" OR host="$field2$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
| rex field=Name "^(?<Service>[^\/]+)[\/]"
| eval key=Service."-".host
| timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime BY host
Hi @jip31 ,
If you want to do a timechart based on host, you could simply do it by
index="windows-wmi" sourcetype="WMI:CPUload" host="$field1$" OR host="$field2$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
| rex field=Name "^(?<Service>[^\/]+)[\/]"
| eval key=Service."-".host
| timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime BY host
THANKS RENJITH
@jip31 , again you are accepting your own answer. If one of the answer is helpful for you, please accept it or vote for it 🙂 .
@asiddique_splunk might be able to help you!
Many thanks!
@jip31 ,if the above answers your question, you shall accept it or vote it 🙂
Hello i have an issue
https://www.cjoint.com/c/HGqh71VI8M0
could you help me please?
index="windows-wmi" sourcetype="WMI:CPUload" host="$field1$" OR host="$field2$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
| rex field=Name "^(?<Service>[^\/]+)[\/]"
| eval key=Service."-".host
| timechart span=10m avg(eval(if(host=="$field1$", PercentProcessorTime, null()))) AS PercentProcessorTime_AVG1
avg(eval(if(host=="$field2$", PercentProcessorTime, null()))) AS PercentProcessorTime_AVG2 BY host
Did you mean to click Accept
here?
Try this:
| timechart span=10m avg(eval(if(host=="$field1$", PercentProcessorTime, null()))) AS PercentProcessorTime_AVG1
avg(eval(if(host=="$field2$", PercentProcessorTime, null()))) AS PercentProcessorTime_AVG2 BY host
Hi @jip31,
You need to enclose arguments of the if statement in a parenthesis like
| timechart span=10m eval(avg(if(host=="$field1$",PercentProcessorTime,NULL))) as PercentProcessorTime_AVG by host
Reference :
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Usestatswithevalexpressionsandfunctions#Ex...