Splunk Search

Display CPU Utilization per host per time using +Add Inputs from Edit Dashboard

hishamjan
Explorer

Hi,

below is the timechart for my search to display CPU utilization of my forwarders and indexerScreenshot 2021-03-02 at 1.46.20 PM.png

Using the host dropdown box, I would like to search for an individual host at a time to display its memFreePct and memUsedPct over a specific period of time (using Time dropdown box). 

The search query is as follows:

 

source="vmstat"
            | dedup host 
 | eval host=upper(host)
            | eval FreeGBs=FreeMBytes/1024, TotalGBs=TotalMBytes/1024, UsedGBs=UsedMBytes/1024
            | table host memFreePct memUsedPct

 

 

Is there a way I can edit this search query to be able to find timechart graph for only one host at a time using the dropdown box?

The search query in the Host dropdown box is as follows:

 

sourcetype=vmstat
| dedup host
|table host

 

 

Thanks in advance for the help.

 

Regards

Labels (5)
0 Karma

jodonald
Explorer

Hi @hishamjan 

You will need to add a field to your search query to include the selected host from your dropdown.

For example, if the token from the dropdown was named "selected_host" then you would modify the search query for the panel to be:

source="vmstat" host=$selected_host$
            | dedup host 
 | eval host=upper(host)
            | eval FreeGBs=FreeMBytes/1024, TotalGBs=TotalMBytes/1024, UsedGBs=UsedMBytes/1024
            | table host memFreePct memUsedPct

 

And you will need to modify the dropdown to assign a value or an "*" (for no selected hosts) to the token "selected_host".  the Splunk documentation for Create and edit forms would be a great place to review those settings.

One more thing to consider, if you want to view the data over time, then you will probably want to modify the search query for your panel to be populated by a timechart instead of eval/table.

 

source="vmstat" host=$selected_host$
| eval host=upper(host)
| eval FreeGBs=FreeMBytes/1024, TotalGBs=TotalMBytes/1024, UsedGBs=UsedMBytes/1024
|timechart avg(memFreePct) as memFreePct, avg(memUsedPct) as memUsedPct by $selected_host$

 

Hope that helps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...