IT Operations Discussions
All the up-time. All the nines.

ITSI Adhoc mstats search not splitting by host entities

Dpeedahnb
Explorer

My base search:

| mstats avg(Processor.%_Processor_Time) AS windows_avgcpu, avg(cpu.idle) AS linux_avgcpuidle, avg(cpu_metric.pctIdle) AS aix_avgcpuidle
avg(LogicalDisk.%_Free_Space) AS windows_avgdiskfree, avg(df.free) AS linux_avgdiskfree, avg(df_metric.UsePct) AS aix_avgdiskused
avg(Memory.%_Committed_Bytes_In_Use) AS windows_avgmemoryused, avg(memory.free) AS linux_avgmemoryfree, avg(vmstat_metric.memFreePct) AS aix_avgmemoryfree
avg(Network_Interface.Bytes_Total/sec) as windows_avgtotalbytes
WHERE `sai_metrics_indexes` BY host
| eval windows_avgdiskused=100-windows_avgdiskfree
| eval linux_avgcpu=100-linux_avgcpuidle, linux_avgdiskused=100-linux_avgdiskfree, linux_avgmemoryused=100-linux_avgmemoryfree
| eval aix_avgcpu=100-aix_avgcpuidle, aix_avgmemoryused=100-aix_avgmemoryfree
| eval avgcpu = coalesce(linux_avgcpu, windows_avgcpu, aix_avgcpu)
| eval avgdiskused = coalesce(windows_avgdiskused, linux_avgdiskused, aix_avgdiskused)
| eval avgmemoryused = coalesce(linux_avgmemoryused, windows_avgmemoryused, aix_avgmemoryused)
| fields host,avgcpu,avgdiskused,avgmemoryused,windows_avgtotalbytes

My entities are split into each host, automatically in a csv, names of entities are host names, with alias being host=(hostname) and also ENTITY_TITLE=(hostname), information is servertype=newage

With no entity splits in the base search, the services work correctly, as well as the KPI's from the base search, however when using a split by host in the base search and filtering to services, the services & KPI's always display as NA when theses settings are made in the base search.

I'll also attach an image of one of my entities produced by the upload using CSV

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!