Splunk Enterprise

Getting multiple entries for a single workload.....

chinmay25
Path Finder

Hello everyone.....I have been trying to get CPU time for different workloads. However, for some workloads I am getting multiple entries of CPU Time.....how do i avoid getting multiple entries?

Please see the query I am working on below...

| fields SMF30JBN DATETIME SMF30CPT
| eval Job_Name=SMF30JBN, Date = substr(DATETIME,1,10)
| eval WORKLOAD = substr(Job_Name,1,3)
| eval CP_Time=SMF30CPT
| eval cpu_time=strptime(SMF30CPT,"%H:%M:%S.%2N")
| eval base=strptime("00:00:00.00","%H:%M:%S.%2N")
| eval ctime=cpu_time-base
| eval ctime=round(ctime, 2)
| stats values(ctime) as CPU_TIME by WORKLOAD Date

Labels (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@chinmay25,

Usually its because of the multi processor systems where you have two or more CPUs . If that's the case, it's a sum of all CPU time taken up by that workload. 

There are other possibilities that the workload has multiple executions per day and/or you are receiving duplicate events etc. Look at your raw events and based on the final requirement, we can fine tune

 

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@chinmay25,

Usually its because of the multi processor systems where you have two or more CPUs . If that's the case, it's a sum of all CPU time taken up by that workload. 

There are other possibilities that the workload has multiple executions per day and/or you are receiving duplicate events etc. Look at your raw events and based on the final requirement, we can fine tune

 

Happy Splunking!

chinmay25
Path Finder

I was able to get the average CPU time. However, I am getting a result as below.

WorkloadCPU_TIMEAVG_TIME
PART A3.5 
PART B2485.4 
AVG_TIME 226.26

 

I want to get the avg time value under the same column as the CPU_TIME.

here is the query that I have

| fields SMF30JBN DATETIME SMF30CPT
| eval Job_Name=SMF30JBN, Date = substr(DATETIME,1,10)
| eval WORKLOAD = substr(Job_Name,1,3)
| eval CP_Time=SMF30CPT
| eval cpu_time=strptime(SMF30CPT,"%H:%M:%S.%2N")
| eval base=strptime("00:00:00.00","%H:%M:%S.%2N")
| eval ctime=cpu_time-base
| eval ctime=round(ctime, 2)
| stats sum(ctime) as CPU_TIME by WORKLOAD
| eval SYST = substr(WORKLOAD,1,1)
| eval TYPE = case(SYST = "F", "PART A PROD",SYST = "M", "PART B PROD")
| appendpipe
[| stats sum(CPU_TIME) as CPU_TIME by TYPE
| eval WORKLOAD="".TYPE." CPU_TIME"]
| fields WORKLOAD CPU_TIME
| append
[search index=cds_ffs_smf030 SMFID=EDCA sourcetype=syncsort:smf030 SMF30STP=5
| fields SMF30JBN DATETIME SMF30CPT
| eval Job_Name=SMF30JBN, Date = substr(DATETIME,1,10)
| eval WORKLOAD = substr(Job_Name,1,3)
| eval CP_Time=SMF30CPT
| eval cpu_time=strptime(SMF30CPT,"%H:%M:%S.%2N")
| eval base=strptime("00:00:00.00","%H:%M:%S.%2N")
| eval ctime=cpu_time-base
| eval ctime=round(ctime, 2)
| stats sum(ctime) as CPU_TIME by WORKLOAD
| stats avg(CPU_TIME) as AVG_TIME
| eval AVG_TIME = round(AVG_TIME, 2)
| eval WORKLOAD="AVG_TIME"]

Tags (1)
0 Karma

chinmay25
Path Finder

The sum helped.

I have calculated the total CPU time for the different workloads. Need to get the average CPU time as well.

Any suggestions?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...