Need help fixing this script to get Splunk Workload Pricing Estimate" It errors out with provide a macro. Thx a mil.

[SamHTexas]

I am trying to use the following to get "Splunk Workload Pricing Estimate" but as stated above it errors out. Do u have a better script / SPL to share please? Thanks a million.

index=_introspection earliest=-30d component=Hostwide

[|inputlookup dmc_assets

| table serverName as host, search_group

| search search_group=*dmc_group_index* OR search_group=*dmc_group_search_head*

| table host ]

| eval cpu_util = ('data.cpu_user_pct' + 'data.cpu_system_pct')

| bin _time span=5m

| table _time host data.cpu_count data.virtual_cpu_count data.cpu_idle_pct data.cpu_idle_pct cpu_util

```5-min Roll-Up```

| stats max(data.cpu_count) AS physical_cores, max(data.virtual_cpu_count) AS numberOfVirtualCores,

max(cpu_util) as CPU_util_pct_max

by _time host

| eval max_5minCPUsUsed = CPU_util_pct_max*numberOfVirtualCores/100

| stats values(host) as host_list dc(host) as total_hosts sum(physical_cores) as physical_cores sum(numberOfVirtualCores) as numberOfVirtualCores

sum(max_5minCPUsUsed) as max_5minCPUsUsed

by _time

```24h Roll-Up```

| bin _time span=1d

| stats values(host_list) as host_list max(total_hosts) as total_hosts max(physical_cores) as physical_cores max(numberOfVirtualCores) as numberOfVirtualCores

p90(max_5minCPUsUsed) as p90Daily_5minMax_CPUsUsed

by _time

```Month Roll-Up```

| appendpipe [

| stats max(total_hosts) as total_hosts, max(physical_cores) as physical_cores, max(numberOfVirtualCores) as numberOfVirtualCores,

p90(p90Daily_5minMax_CPUsUsed) as p90Daily_5minMax_CPUsUsed

| eval _time="90th Perc. across report duration (equivalent to 3 days out of 30)"]

| eval p90Daily_5minMax_CPUsUsed=round(p90Daily_5minMax_CPUsUsed,2)

[SamHTexas]

Thank u sir for your message. I get an error about a macro on Splunk 8.0.7 & 8.2.3. Rich sir, I need to be running this search on  MC (DMC) correct? Thank u sir as always.

[richgalloway]

Yes, the search must run on the MC.

[richgalloway]

The query runs fine on my sandbox.  Perhaps Splunk doesn't like the triple backticks.  Are you running a version that supports that form of comment?