Getting Data In

help with mstats needed

damucka
Builder

Hello,

I have a metric index reflecting the OS kpis (unix nmon tool).
In order to process the data with ML algorithms, I would like to extract it in the following form:

_time, metric1, metric2, ...., metricN, host

At the moment it is in the form:

_time, metric_name, host

I extract it with the following search:

| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name=* groupby metric_name, host span=1m

How would the search command have to look like to achieve my goal?
Also, the second question is how can I exclude metrics with a specific name pattern from the search? I tried with the following:

| mstats avg(_value) WHERE index=os-unix-nmon-metrics AND metric_name!= "*cpunn*"  groupby metric_name, host span=1m

... but the above does not get accepted throwing error:

Error in 'mstats' command: Missing metric_name filter after 'WHERE' keyword. For performance reason, only search on a subset of metric_names are allowed.

Kind Regards,
Kamil

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@damucka

Can you please check **** section in below doc?'

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Mstats

Description: An expression describing the filters that are applied to your search. Includes time and search modifiers, comparison expressions, and index expressions. See the following sections for descriptions of each of these logical expression components.
**Cannot filter on metric_name**. Does not support CASE or TERM directives. You also cannot use the WHERE clause to search for terms or phrases.
0 Karma

damucka
Builder

@kamlesh_vaghela

Thank you. As I understand it, there is no way to restrict on the metric_name using pattern.

Kind Regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...