Getting Data In

help with mstats needed



I have a metric index reflecting the OS kpis (unix nmon tool).
In order to process the data with ML algorithms, I would like to extract it in the following form:

_time, metric1, metric2, ...., metricN, host

At the moment it is in the form:

_time, metric_name, host

I extract it with the following search:

| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name=* groupby metric_name, host span=1m

How would the search command have to look like to achieve my goal?
Also, the second question is how can I exclude metrics with a specific name pattern from the search? I tried with the following:

| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name!= "*cpunn*"  groupby metric_name, host span=1m

... but the above does not get accepted throwing error:

Error in 'mstats' command: Missing metric_name filter after 'WHERE' keyword. For performance reason, only search on a subset of metric_names are allowed.

Kind Regards,

0 Karma



Can you please check **** section in below doc?'

Description: An expression describing the filters that are applied to your search. Includes time and search modifiers, comparison expressions, and index expressions. See the following sections for descriptions of each of these logical expression components.
**Cannot filter on metric_name**. Does not support CASE or TERM directives. You also cannot use the WHERE clause to search for terms or phrases.
0 Karma



Thank you. As I understand it, there is no way to restrict on the metric_name using pattern.

Kind Regards,

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST