Getting Data In

Generate graph from 'CPU RAM process' log

splunk_zen
Builder

How should I configure the Search (and Report) so to get a CPU & RAM line chart (the values not a count) by process?

This is my current log file format,

1.3 0.1 python

2.9 11.3 /usr/libexec/mysqld --basedir=/usr

2.0 0.1 sqlplus

0.0 0.1 ./smt_collector

0.0 0.0 ora_dia0_zabbix

0.0 0.0 /opt/ptin/zabbix/sbin/zabbix_agentd

0.0 0.0 /opt/ptin/zabbix/sbin/zabbix_agentd

0.1 0.9 splunkd

0.1 0.2 ./uzo_collector

0.3 0.5 /bin/sh

This is my current Search,

source="/opt/splunk/monitoring_logs/ps.log" | rex field=_raw "(?<field1>\d*) (?<field2>\d*) (?<field3>\s*)" | timechart
Tags (2)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Do these rex extractions really work, e.g. does \d* match 0.1?

If it doesn't, I'd try

rex field=_raw "(?<field1>[\S]+)\s+(?<field2>\S+)\s+(?<field3>.*)$" 

As for the charting, have you tried the "Advanced Charting" wizard? I believe that it is still found under the "Dashboards & Views" menu in the Search app. The following search gave what I believe is what you want;

your_search| multikv noheader=t | rex (?<CPU>\S+)\s+(?<MEM>\S+)\s+(?<PROCESS>.*)$ | timechart values(CPU) AS CPU_usage values(MEM) AS Memory_usage by PROCESS

The charting options were, chart type: line, Multi-series mode: combined, Missing values: connect.

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Do these rex extractions really work, e.g. does \d* match 0.1?

If it doesn't, I'd try

rex field=_raw "(?<field1>[\S]+)\s+(?<field2>\S+)\s+(?<field3>.*)$" 

As for the charting, have you tried the "Advanced Charting" wizard? I believe that it is still found under the "Dashboards & Views" menu in the Search app. The following search gave what I believe is what you want;

your_search| multikv noheader=t | rex (?<CPU>\S+)\s+(?<MEM>\S+)\s+(?<PROCESS>.*)$ | timechart values(CPU) AS CPU_usage values(MEM) AS Memory_usage by PROCESS

The charting options were, chart type: line, Multi-series mode: combined, Missing values: connect.

Hope this helps,

Kristian

kristian_kolb
Ultra Champion

You're most welcome 🙂 /k

0 Karma

splunk_zen
Builder

Thanks kristian. Like you've already guessed I'm still not experienced in the search parameters, I'll take a look into multikv and the other structures.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...