Splunk Search

Charting values from performance record

snowmizer
SplunkTrust
SplunkTrust

I've got a log file that contains, time, controller, and CPU % used. I need to create a time chart that plots the CPU % from the record. I've messed with different timechart and stats functions but nothing pulls the exact CPU % from the record and plots it by time.

What's the best way to do this?

Thanks.

Tags (1)
0 Karma
1 Solution

christopherutz
Path Finder

I suspect what you are not liking is the fact that timechart buckets events and you must supply some aggregator (sum, max, avg) for your field? Have you tried decreasing your span such that you can guarantee there will only be one event per bucket? In this case an average becomes the exact value you are looking for.

my search terms | timechart span=5sec avg(CPU%)

View solution in original post

snowmizer
SplunkTrust
SplunkTrust

Thanks again for the suggestion.

0 Karma

christopherutz
Path Finder

I suspect what you are not liking is the fact that timechart buckets events and you must supply some aggregator (sum, max, avg) for your field? Have you tried decreasing your span such that you can guarantee there will only be one event per bucket? In this case an average becomes the exact value you are looking for.

my search terms | timechart span=5sec avg(CPU%)

View solution in original post

snowmizer
SplunkTrust
SplunkTrust

Thanks for the suggestion. I forgot that span can be used with timechart.

My data is broken up in 1 minute periods so using the span=1m resulted in too many buckets. I think I'll be fine if I just average the data over 5 minute periods. I think anything less would be too granular anyway. If I want the 1 minute data I can just look at the raw data for that period.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!