help with mstats needed

[damucka]

Hello,

I have a metric index reflecting the OS kpis (unix nmon tool).
In order to process the data with ML algorithms, I would like to extract it in the following form:

_time, metric1, metric2, ...., metricN, host

At the moment it is in the form:

_time, metric_name, host

I extract it with the following search:

| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name=* groupby metric_name, host span=1m

How would the search command have to look like to achieve my goal?
Also, the second question is how can I exclude metrics with a specific name pattern from the search? I tried with the following:

| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name!= "*cpunn*"  groupby metric_name, host span=1m

... but the above does not get accepted throwing error:

Error in 'mstats' command: Missing metric_name filter after 'WHERE' keyword. For performance reason, only search on a subset of metric_names are allowed.

Kind Regards,
Kamil

[kamlesh_vaghela]

@damucka

Can you please check **** section in below doc?'

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Mstats

Description: An expression describing the filters that are applied to your search. Includes time and search modifiers, comparison expressions, and index expressions. See the following sections for descriptions of each of these logical expression components.
**Cannot filter on metric_name**. Does not support CASE or TERM directives. You also cannot use the WHERE clause to search for terms or phrases.

[damucka]

@kamlesh_vaghela

Thank you. As I understand it, there is no way to restrict on the metric_name using pattern.

Kind Regards,
Kamil