Dashboards & Visualizations

Using a lookup with the list of servernames and servertypes (SH,IN,CT) under the field hosts, how do I check CPU usage for servers of any particular type?

Harishma
Communicator

Hi

I have a lookup table with the list of servernames and servertypes (SH,IN,CT) under the field hosts like below:

Hosts   servertype
A           SH
B           SH
C           IN
.
.
.
.
Z            CT

I want to check the CPU Usage for servers of any particular type i.e I want to display the usage of all servers of servertype SH, on a dashboard. I'm using the below search, but it doesn't work. Can someone pls help me on this??

|inputlookup ServerList.csv |  search servertype=SH  index=sys_* sourcetype=cpu | multikv fields pctIdle   | eval Percent_CPU_Load = 100 - pctIdle   | timechart span=1h avg(Percent_CPU_Load) as pctLoad by hosts
Tags (4)
0 Karma
1 Solution

sundareshr
Legend

Try this

index=sys_* sourcetype=cpu  | lookup  ServerList.csv host as Hosts OUTPUT servertype | search servertype=SH | ...

View solution in original post

sundareshr
Legend

Try this

index=sys_* sourcetype=cpu  | lookup  ServerList.csv host as Hosts OUTPUT servertype | search servertype=SH | ...

Harishma
Communicator

Hi,

Thanks for the response.. it worked.
Im now displaying the cpu usage for all the servers of servertye AH ona graph.Each server is displayed with a diffrent color. But incase the the CPU usage for any server goes beyong a threshold(say 90%), I want to highlight these servers in the panel. Is there a way to do this? Please let me know how I can get this done??

0 Karma

sundareshr
Legend

@Harishma If your original question was answered, Please mark this question a accepted to others with similar issue will know this one was resolved.

As for your second question, check out this answer https://answers.splunk.com/answers/83206/color-in-a-table-based-on-values.html

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...