Reporting

how to plot a time chart with average of some fields for some devices

sanjeev
Explorer

Need to plot a time chart of some mac with average of Mem0, Mem1, CPU0, CPU1 and CPU2.

(index=metrics OR index=hc_trials OR index=hc_prod) (HCTELEM OR HCJUNK) uptime>1800
| fields + payload version deviceid mac uptime
| eval payload=replace(payload, "\"\"", "\"")
| spath input=payload output=Mem0 path=Mem{0}
| spath input=payload output=Mem1 path=Mem{1}
| spath input=payload output=CPU0 path=CPU{0}
| spath input=payload output=CPU1 path=CPU{1}
| spath input=payload output=CPU2 path=CPU{2}
| table mac Mem0 Mem1 CPU0 CPU1 CPU2

 

 

@thambisetty 

Labels (3)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

you can change span=whateveryouwant , I have aggregated events to 10minutes

you can't actually plot 3 axis - _time, mac and averages on 2D graphs.

 

(index=metrics OR index=hc_trials OR index=hc_prod) (HCTELEM OR HCJUNK) uptime>1800
| fields + payload version deviceid mac uptime
| eval payload=replace(payload, "\"\"", "\"")
| spath input=payload output=Mem0 path=Mem{0}
| spath input=payload output=Mem1 path=Mem{1}
| spath input=payload output=CPU0 path=CPU{0}
| spath input=payload output=CPU1 path=CPU{1}
| spath input=payload output=CPU2 path=CPU{2}
| bin _time span=10m
| stats avg(Mem0) as avg_Mem0 avg(Mem1) as avg_Mem1 avg(CPU0) as avg_CPU0 avg(CPU1) as avg_CPU1 avg(CPU2) as avg_CPU2 by _time,mac

 

  

————————————
If this helps, give a like below.
0 Karma

sanjeev
Explorer

I need the average of only these devices 24A7DCFFB120,24A7DCFFB480,24A7DCFFB730,3C8994CCFB80,24A7DCFFBB30,24A7DCFFA150,80721552DB50,3C8994718568,24A7DCFFAB78,3C8994558170,807215405D08,3C8994782528,3C8994667D78,3C8994788B70,3C899467CBC8,3C8994731588,24A7DCFFA650,3C8994763F88,3C8994764D68

 

 

can i use a where 

| where mac like (24A7DCFFB120,24A7DCFFB480,24A7DCFFB730,3C8994CCFB80,24A7DCFFBB30,24A7DCFFA150,80721552DB50,3C8994718568,24A7DCFFAB78,3C8994558170,807215405D08,3C8994782528,3C8994667D78,3C8994788B70,3C899467CBC8,3C8994731588,24A7DCFFA650,3C8994763F88,3C8994764D68)

0 Karma

sanjeev
Explorer

Actually i need the average of (Mem0) ,(Mem1) ,(CPU0) ,(CPU1) &(CPU2) for these 21 devices aggregated

0 Karma

sanjeev
Explorer

something like this for all 21 devices aggregated on daily basis.

_timeavg_Mem0avg_Mem1avg_CPU0avg_CPU1avg_CPU2
01-08-2020288896777867698981232
02-08-2020287656875897696761342
03-08-2020265426543823197541423
04-08-2020265796231835495431876
Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...