Using a lookup with the list of servernames and servertypes (SH,IN,CT) under the field hosts, how do I check CPU usage for servers of any particular type?

[Harishma]

Hi

I have a lookup table with the list of servernames and servertypes (SH,IN,CT) under the field hosts like below:

Hosts   servertype
A           SH
B           SH
C           IN
.
.
.
.
Z            CT

I want to check the CPU Usage for servers of any particular type i.e I want to display the usage of all servers of servertype SH, on a dashboard. I'm using the below search, but it doesn't work. Can someone pls help me on this??

|inputlookup ServerList.csv |  search servertype=SH  index=sys_* sourcetype=cpu | multikv fields pctIdle   | eval Percent_CPU_Load = 100 - pctIdle   | timechart span=1h avg(Percent_CPU_Load) as pctLoad by hosts

[sundareshr · Accepted solution]

Try this

index=sys_* sourcetype=cpu  | lookup  ServerList.csv host as Hosts OUTPUT servertype | search servertype=SH | ...

[Harishma]

Hi,

Thanks for the response.. it worked.
Im now displaying the cpu usage for all the servers of servertye AH ona graph.Each server is displayed with a diffrent color. But incase the the CPU usage for any server goes beyong a threshold(say 90%), I want to highlight these servers in the panel. Is there a way to do this? Please let me know how I can get this done??

[sundareshr]

@Harishma If your original question was answered, Please mark this question a accepted to others with similar issue will know this one was resolved.

As for your second question, check out this answer https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html