Does stats understand the % symbol?

[mathewboarman]

Hi,
My events actually report CPU and Mem utilization... 35.45% and 25.56%
I extract these over time but I don't get Lines on my chart.
I'm wondering if these fields are read as text... so cant be graphed?
My search is below

CSCOacs_System_Statistics host="bob" | stats list(SysStatsUtilizationMemory) as MemUtil list(SysStatsUtilizationCpu) as CPU_Util by _time

I'm wondering if I need to strip out the % from the results... or if I should be using a different tool... timechart or something.

thanks

[jimodonald]

I think you'd want to strip the percent signs out.

and if you're building chart, try using the chart or timechart instead of stats. Stats will still work, but it's easy to get carried away with the by clauses.

And I'd recommend you change the "list" to "avg" in order to assure you're only getting a single datapoint per time. Multiple data points per time don't graph.

so you'd end up with something like these (which are identical in output).

| chart avg(SysStatsUtilizationMemory) as MemUtil avg(SysStatsUtilizationCpu) as CPU_Util over _time

-or-

| timechart avg(SysStatsUtilizationMemory) as MemUtil avg(SysStatsUtilizationCpu) as CPU_Util

[somesoni2]

You would need numerical data for displaying charts, be it using stats, chart, timechart or any other statistical command. I would suggest something like this:

CSCOacs_System_Statistics host="bob" | replace *% with * in SysStatsUtilizationMemory,SysStatsUtilizationCpu| stats list(SysStatsUtilizationMemory) as "MemUtil%" list(SysStatsUtilizationCpu) as "CPU_Util%" by _time

Adding "%" to the labels will show % sign before the value (not same but close).

Update

Give this a try

CSCOacs_System_Statistics host="bob" | replace *% with * in SysStatsUtilizationMemory,SysStatsUtilizationCpu| chart list(SysStatsUtilizationMemory) as "MemUtil%" list(SysStatsUtilizationCpu) as "CPU_Util%" over _time by host

[somesoni2]

Try the updated answer. I believe the output series will be like "CPU_Util%:hostName".

[mathewboarman]

... and is it possible to include the host in the label...

ie ... as $host_CPU_Util% by time

many thanks

[mathewboarman]

perfect, thank you