Dashboards & Visualizations

Using a lookup with the list of servernames and servertypes (SH,IN,CT) under the field hosts, how do I check CPU usage for servers of any particular type?

Harishma
Communicator

Hi

I have a lookup table with the list of servernames and servertypes (SH,IN,CT) under the field hosts like below:

Hosts   servertype
A           SH
B           SH
C           IN
.
.
.
.
Z            CT

I want to check the CPU Usage for servers of any particular type i.e I want to display the usage of all servers of servertype SH, on a dashboard. I'm using the below search, but it doesn't work. Can someone pls help me on this??

|inputlookup ServerList.csv |  search servertype=SH  index=sys_* sourcetype=cpu | multikv fields pctIdle   | eval Percent_CPU_Load = 100 - pctIdle   | timechart span=1h avg(Percent_CPU_Load) as pctLoad by hosts
Tags (4)
0 Karma
1 Solution

sundareshr
Legend

Try this

index=sys_* sourcetype=cpu  | lookup  ServerList.csv host as Hosts OUTPUT servertype | search servertype=SH | ...

View solution in original post

sundareshr
Legend

Try this

index=sys_* sourcetype=cpu  | lookup  ServerList.csv host as Hosts OUTPUT servertype | search servertype=SH | ...

Harishma
Communicator

Hi,

Thanks for the response.. it worked.
Im now displaying the cpu usage for all the servers of servertye AH ona graph.Each server is displayed with a diffrent color. But incase the the CPU usage for any server goes beyong a threshold(say 90%), I want to highlight these servers in the panel. Is there a way to do this? Please let me know how I can get this done??

0 Karma

sundareshr
Legend

@Harishma If your original question was answered, Please mark this question a accepted to others with similar issue will know this one was resolved.

As for your second question, check out this answer https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...