Hi,
I am using the below query to bring the output in graph dashboard but this query gives Disk memory values is same . I have attached the output also. Can anyone help me
Query:
index=oswin sourcetype="Perfmon:Processor" host=COPYCAR01
| timechart avg(cpu_load_percent) as CPU span=15min
| join type=left host
[| mstats avg("Memory.%_Committed_Bytes_In_Use") as Memory WHERE index=oswinperf AND host=COPYCAR01 span=15min ]
| join type=left host
[| mstats avg("LogicalDisk.%_Free_Space") as Diskfree WHERE index=oswinperf AND host=COPYCAR01 span=15min
| eval DISK=100 - Diskfree
| table _time,DISK]
Output:
_time CPU DISK Memory
2022-03-24 09:00:00 55.78524325650826 57.29944034187627 11.84846114177454
2022-03-24 09:15:00 59.38775699798989 57.29944034187627 11.84846114177454
2022-03-24 09:30:00 56.71582822628451 57.29944034187627 11.84846114177454
You are getting the same because you are joining by host and not by host/_time
Since you're getting already metrics data why not use CPU metrics data as well? That would make you search something like this:
| mstats avg("Processor.%_Processor_Time") AS CPU avg("Memory.%_Committed_Bytes_In_Use") as Memory avg("LogicalDisk.%_Free_Space") as Diskfree WHERE index=oswinperf AND host=COPYCAR01 span=15min
| eval DISK=100 - Diskfree
| table _time CPU Memory DISK
Way better since you do not need to use join.
Actually the cpu metric did not return the correct values. thats why
can you help me to bring the output?
Hi @jackin
what is the object and counter configured for you cpu metrics in your splunk and is your CPU data in sourcetype="Perfmon:Processor" i thought it is usually in different sourcetype
like Memory.%_Committed_Bytes_In_Use is for memory
and LogicalDisk.%_Free_Space is for free space
In search and report ,in the analytics tab you can check which metrics you're collecting