visualization

[SN1]

Hello I have this search
| rest splunk_server=MSE-SVSPLUNKI01 /services/server/status/resource-usage/hostwide
| eval cpu_usage = cpu_system_pct + cpu_user_pct
| where cpu_usage > 10

I want to this search to give a graph visualization of total cpu_usage every 4 hours.

[kiran_panchavat]

@SN1 

You can modify your search to aggregate cpu_usage over 4-hour intervals and visualize it. 

[livehybrid]

Hi @SN1 

You can achieve this with the following search - please see screenshot below for actual example output too.

index="_introspection" component=Hostwide earliest=-4h host=<yourHostname>
| eval cpu_usage = 'data.cpu_system_pct' + 'data.cpu_user_pct' 
| timechart span=5m avg(cpu_usage) as avg_cpu_usage

I dont think the other answer provided would work because the REST endpoint does not output a timeseries, its a one-time view of this data.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[SN1]

SO i want total cpu usage for indexer only

[livehybrid]

That is fine, just set host=<yourIndexer> after index=_introspection and you should get this.