Splunk Search

Combining results in metric index?

winknotes
Path Finder

I have a metric index with a hierarchical structure (maybe all metric indexes are like this).  
SuperCategory.Category1.metric1
                                                  .metric2
                                                  .metric3
SuperCategory.Category2.metric1
                                                      .metric2

There is a many to one relationship between categories.  I've tried many different combination methods but my starting point was:

 

 

 

|  mstats  avg(Vmax.StorageGroup.HostIOs) as IOPs avg(Vmax.StorageGroup.AllocatedCapacity) as SgCapacity avg(Vmax.Array.UsableCapacity) as ArrayCap avg(Vmax.Array.HostIOs) as ArrayIOPS 
WHERE index=storage_metrics by Array_Name, Loc, sgname span=1d 
| eval SgIOPs = round(IOPs, 2), SgCapacity = round(SgCapacity, 2), SgCapPct=round((SgCapacity/ArrayCap)*100, 2), SgIOPct=round((IOPs/ArrayIOPS)*100, 2)
| table sgname Array_Name Loc SgIOPs ArrayIOPS SgIOPct SgCapacity ArrayCap SgCapPct  _time

 

 

 

Nothing is returned for any of the Vmax.Array metrics.  There are many 'sgname' to any single 'Array_Name'.  As you can probably tell I'm trying to calculate what % of an array total an sgname is using.  I find myself in this situation quite often and don't really know how to handle it.  

I appreciate any help anyone can offer.   

 

Labels (2)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...