Monitoring Splunk

Find the max and min cpu per host

New Member

I have four hosts. H1, H2, H3, H4
each host have cpu_load

I want to find min cpu_load and max cpu_load. Find the min/max out of all host. In My scenario out of 4 host, find the min/max.

| stats min(host of cpu_load) as Min, max(host of cpu_load) | eval diff=max-min | alert based on diff

Any help is appreciated. Thank you

Labels (2)
Tags (4)
0 Karma

New Member

I changed the question a bit.

... | stats count by host


H1 200
H2 340
H3 400
H4 250

The count of each host is different. How would you eval min_value and max_value of these host counts?

0 Karma

Ultra Champion
| stats count by host
| eventstats max(count) as max_value min(count) as min_value
| eval diff = max_value - min_value

try eventstats

0 Karma


try this:

| stats max(cpu_load) as max_tmp min(cpu_load) as min_tmp by host
| eventstats max(max_tmp) as max_final min(min_tmp) as min_final
| eval max_flag=if(max_tmp=max_final,1,0) , min_flag=if(min_tmp=min_final,1,0)
| where min_flag=1 OR max_flag=1

0 Karma


|stats max(cpu_load) as max min(cpu_load) as min by host

0 Karma

New Member

mmm.. It didn't do it. Let me ask the question in different way. Lets forget about CPU. Lets say each host is giving you count of sessions or count of traffic.

index=app | stats count by host

result based on 4 host

How would you find max count out of 4 host

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...