Splunk Search

Does stats understand the % symbol?

mathewboarman
Explorer

Hi,
My events actually report CPU and Mem utilization... 35.45% and 25.56%
I extract these over time but I don't get Lines on my chart.
I'm wondering if these fields are read as text... so cant be graphed?
My search is below

CSCOacs_System_Statistics host="bob" | stats list(SysStatsUtilizationMemory) as MemUtil list(SysStatsUtilizationCpu) as CPU_Util by _time

I'm wondering if I need to strip out the % from the results... or if I should be using a different tool... timechart or something.

thanks

Tags (1)
0 Karma

jimodonald
Contributor

I think you'd want to strip the percent signs out.

and if you're building chart, try using the chart or timechart instead of stats. Stats will still work, but it's easy to get carried away with the by clauses.

And I'd recommend you change the "list" to "avg" in order to assure you're only getting a single datapoint per time. Multiple data points per time don't graph.

so you'd end up with something like these (which are identical in output).

| chart avg(SysStatsUtilizationMemory) as MemUtil avg(SysStatsUtilizationCpu) as CPU_Util over _time

-or-

| timechart avg(SysStatsUtilizationMemory) as MemUtil avg(SysStatsUtilizationCpu) as CPU_Util
0 Karma

somesoni2
Revered Legend

You would need numerical data for displaying charts, be it using stats, chart, timechart or any other statistical command. I would suggest something like this:

CSCOacs_System_Statistics host="bob" | replace *% with * in SysStatsUtilizationMemory,SysStatsUtilizationCpu| stats list(SysStatsUtilizationMemory) as "MemUtil%" list(SysStatsUtilizationCpu) as "CPU_Util%" by _time

Adding "%" to the labels will show % sign before the value (not same but close).

Update

Give this a try

CSCOacs_System_Statistics host="bob" | replace *% with * in SysStatsUtilizationMemory,SysStatsUtilizationCpu| chart list(SysStatsUtilizationMemory) as "MemUtil%" list(SysStatsUtilizationCpu) as "CPU_Util%" over _time by host

somesoni2
Revered Legend

Try the updated answer. I believe the output series will be like "CPU_Util%:hostName".

0 Karma

mathewboarman
Explorer

... and is it possible to include the host in the label...

ie ... as $host_CPU_Util% by time

many thanks

0 Karma

mathewboarman
Explorer

perfect, thank you

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>