Dashboards & Visualizations

How to use join command to output in graph dashboard?

jackin
Path Finder

Hi,

I am using the below query to bring the output in graph dashboard but this query gives Disk memory values is same . I have attached the output also. Can anyone help me 

Query:

index=oswin sourcetype="Perfmon:Processor" host=COPYCAR01 
| timechart avg(cpu_load_percent) as CPU span=15min
| join type=left host
[| mstats avg("Memory.%_Committed_Bytes_In_Use") as Memory WHERE index=oswinperf AND host=COPYCAR01 span=15min ]
| join type=left host
[| mstats avg("LogicalDisk.%_Free_Space") as Diskfree WHERE index=oswinperf AND host=COPYCAR01 span=15min
| eval DISK=100 - Diskfree
| table _time,DISK]

 

Output:

_time               CPU                  DISK            Memory
2022-03-24 09:00:00 55.78524325650826 57.29944034187627 11.84846114177454
2022-03-24 09:15:00 59.38775699798989 57.29944034187627 11.84846114177454
2022-03-24 09:30:00 56.71582822628451 57.29944034187627 11.84846114177454

 

Labels (2)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

You are getting the same because you are joining by host and not by host/_time

Since you're getting already metrics data why not use CPU metrics data as well? That would make you search something like this:

| mstats avg("Processor.%_Processor_Time") AS CPU avg("Memory.%_Committed_Bytes_In_Use") as Memory avg("LogicalDisk.%_Free_Space") as Diskfree WHERE index=oswinperf AND host=COPYCAR01 span=15min 
| eval DISK=100 - Diskfree 
| table _time CPU Memory DISK


Way better since you do not need to use join.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

jackin
Path Finder

Hi@diogofgm 

 Actually the cpu metric did not return the correct values. thats why

can you help me to bring the output?

0 Karma

venky1544
Builder

Hi @jackin 

what is the object and counter configured for you cpu metrics in your splunk and is your CPU data in sourcetype="Perfmon:Processor" i thought it is usually in different sourcetype 

like Memory.%_Committed_Bytes_In_Use  is for memory 

and LogicalDisk.%_Free_Space  is for free space 

 

0 Karma

diogofgm
SplunkTrust
SplunkTrust

In search and report ,in the analytics tab you can check which metrics you're collecting

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...