Dashboards & Visualizations

How can i create a dashboard with avg cpu usage over 30 days, broken by timeframe

shreyasathavale
Communicator

I have dashboard with avg cpu usage 30 days but now i want to break it with timeframe like:
• One window for 12am-8am, one window from 8am-4pm, one window from 4pm-12am

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

you can try something like this

index=os sourcetype=cpu cpu=all 
| eval pctBusy=100-pctIdle 
| eval date_hour=strftime(_time,"%H") 
| eval date=case(date_hour>=0 AND date_hour<8,"12am-8am",date_hour>=8 AND date_hour<16,"8am-4pm",date_hour>=16 AND date_hour<24,"4pm-12am") 
| chart avg(pctBusy) as avg over host by date 
| foreach 12am-8am 8am-4pm 4pm-12am 
    [ eval <<FIELD>>=round('<<FIELD>>')] 
| sort by host

let me know if this helps!

View solution in original post

deepashri_123
Motivator

Hey shreyasathavale,

You can try this query below:

index=abc role=xyz sourcetype=cpu cpu=all|eval pctBusy=100-pctIdle|eval time=case(date_hour>0 AND date_hour<8,"slot1",date_hour>8 AND date_hour<16,"slot2",date_hour>16 AND date_hour<24,"slot3")|chart avg(pctBusy) by host,time|eval AvgCPU=round('avg(pctBusy)',2)|rename AvgCPU As "Average CPU" |fields host,"Average CPU","time"|sort by host

Hope this helps!!

0 Karma

shreyasathavale
Communicator

This did not provide any result sadly.. but mayurr98's answer worked. Thanks again!!

0 Karma

mayurr98
Super Champion

you can try something like this

index=os sourcetype=cpu cpu=all 
| eval pctBusy=100-pctIdle 
| eval date_hour=strftime(_time,"%H") 
| eval date=case(date_hour>=0 AND date_hour<8,"12am-8am",date_hour>=8 AND date_hour<16,"8am-4pm",date_hour>=16 AND date_hour<24,"4pm-12am") 
| chart avg(pctBusy) as avg over host by date 
| foreach 12am-8am 8am-4pm 4pm-12am 
    [ eval <<FIELD>>=round('<<FIELD>>')] 
| sort by host

let me know if this helps!

shreyasathavale
Communicator

Thanks a lot mayurr98 !!!

0 Karma

mayurr98
Super Champion

can you provide search query?

0 Karma

shreyasathavale
Communicator

index=abc role=xyz sourcetype=cpu cpu=all|eval pctBusy=100-pctIdle|chart avg(pctBusy) by host|eval AvgCPU=round('avg(pctBusy)',2)|rename AvgCPU As "Average CPU" |fields host,"Average CPU"|sort by host

I have set earliest=-30d@d latest=now

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...