Getting Data In

help with mstats needed

damucka
Builder

Hello,

I have a metric index reflecting the OS kpis (unix nmon tool).
In order to process the data with ML algorithms, I would like to extract it in the following form:

_time, metric1, metric2, ...., metricN, host

At the moment it is in the form:

_time, metric_name, host

I extract it with the following search:

| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name=* groupby metric_name, host span=1m

How would the search command have to look like to achieve my goal?
Also, the second question is how can I exclude metrics with a specific name pattern from the search? I tried with the following:

| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name!= "*cpunn*"  groupby metric_name, host span=1m

... but the above does not get accepted throwing error:

Error in 'mstats' command: Missing metric_name filter after 'WHERE' keyword. For performance reason, only search on a subset of metric_names are allowed.

Kind Regards,
Kamil

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@damucka

Can you please check **** section in below doc?'

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Mstats

Description: An expression describing the filters that are applied to your search. Includes time and search modifiers, comparison expressions, and index expressions. See the following sections for descriptions of each of these logical expression components.
**Cannot filter on metric_name**. Does not support CASE or TERM directives. You also cannot use the WHERE clause to search for terms or phrases.
0 Karma

damucka
Builder

@kamlesh_vaghela

Thank you. As I understand it, there is no way to restrict on the metric_name using pattern.

Kind Regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...