Deployment Architecture

Use of output from two indexes

aksampat
New Member

Hi,

I need some help with building a query where the output comes from two different indexes.
Index1:
index=A sourcetype=B | eval cpu_used=1-cpu_idle | eval totalcpu = cpu_used*100

Index2:
index=C sourcetype=D timechart count span=1m AS REQ

Now I need to combine these two and do totalcpu/REQ
How to do this?

Thanks,
Amit

Tags (1)
0 Karma

aksampat
New Member

Thank you all

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi Aksampat, as you are a new member, thought to remind you - Can you please accept as answer.. maybe an upvote for the unaccepted answer

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi Aksampat, as you are a new member, thought to remind you - Can you please accept as answer.. maybe an upvote for the unaccepted answer

0 Karma

inventsekar
SplunkTrust
SplunkTrust

following MuS's great post, lets check this one -

index=A OR index=C sourcetype=B OR sourcetype=D 
| eval cpu_used=1-cpu_idle | eval totalcpu = cpu_used*100 | stats values(count) AS REQ 
| eval result = totalcpu/REQ
0 Karma

MuS
Legend

Hi aksampat,

I will not solve your problem right now, BUT a good starting point is this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... or the awesome March 2016 post on this page http://wiki.splunk.com/Virtual_.conf

Keep pushing and use stats to the limits 😉

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...