Splunk Enterprise

Unable to Merge the columns....

chinmay25
Path Finder

I was able to get the average CPU time. However, I am getting a result as below.

WorkloadCPU_TIMEAVG_TIME
PART A3.5 
PART B2485.4 
AVG_TIME 226.26

 

I want to get the avg time value under the same column as the CPU_TIME.

here is the query that I have

| fields SMF30JBN DATETIME SMF30CPT
| eval Job_Name=SMF30JBN, Date = substr(DATETIME,1,10)
| eval WORKLOAD = substr(Job_Name,1,3)
| eval CP_Time=SMF30CPT
| eval cpu_time=strptime(SMF30CPT,"%H:%M:%S.%2N")
| eval base=strptime("00:00:00.00","%H:%M:%S.%2N")
| eval ctime=cpu_time-base
| eval ctime=round(ctime, 2)
| stats sum(ctime) as CPU_TIME by WORKLOAD
| eval SYST = substr(WORKLOAD,1,1)
| eval TYPE = case(SYST = "F", "PART A PROD",SYST = "M", "PART B PROD")
| appendpipe
[| stats sum(CPU_TIME) as CPU_TIME by TYPE
| eval WORKLOAD="".TYPE." CPU_TIME"]
| fields WORKLOAD CPU_TIME
| append
[search index=cds_ffs_smf030 SMFID=EDCA sourcetype=syncsort:smf030 SMF30STP=5
| fields SMF30JBN DATETIME SMF30CPT
| eval Job_Name=SMF30JBN, Date = substr(DATETIME,1,10)
| eval WORKLOAD = substr(Job_Name,1,3)
| eval CP_Time=SMF30CPT
| eval cpu_time=strptime(SMF30CPT,"%H:%M:%S.%2N")
| eval base=strptime("00:00:00.00","%H:%M:%S.%2N")
| eval ctime=cpu_time-base
| eval ctime=round(ctime, 2)
| stats sum(ctime) as CPU_TIME by WORKLOAD
| stats avg(CPU_TIME) as AVG_TIME
| eval AVG_TIME = round(AVG_TIME, 2)
| eval WORKLOAD="AVG_TIME"]

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Change the last three lines of your query.

| stats avg(CPU_TIME) as CPU_TIME
| eval CPU_TIME= round(CPU_TIME, 2)
| eval WORKLOAD="AVG_TIME"]

There may be other ways to make the search more efficient, but that change should do the job. 

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!