Evaluation of CPU_power

[LKrieger]

Hi Splunkers,

Iam a beginner at splunk. So I managed to get all Data from Aida64 into Splunk. That does include Temperatures, Mhz Clocks of all Cores, TDP-Values etc.

Now I wanted to try to get a nice timechart from the average CPU Power usage of the System per Minute. The Problem is that all the values are entering splunk with a timeframe of around 2-4 seconds from the system.  Here is an example:

The field CPU_power is the necessary one which I want to have a timechart from.

A normal timechart search was not possible for me, because I only get it managed to show all the values at per line in the timechart.

Another try was then to sum all values in a minute together and divide them by the amount of counts per minute. But there I get not result per minute then...

Actually I dont know how to manage this.

Hopefully you can help me out here.

[LKrieger]

Hi ITWhisperer,

thanks man, this did the trick!!

But actually I am not sure what you mean mit aligned. Do you mean by language maybe the "." and "," notation for english and german language, regarding the separation after the deciaml place?

Actually the Log from aida looks like this:

So the values are separated by semicolons. As you can see the forth last place is the value for the cpu_power (First line as example 124,20). So the decimal place is separated by ",". Did you mean this by aligned and regarding the language?

How can I change this in Splunk, maybe then without using the separate eval command from your query?

[ITWhisperer]

Values in the yellow column are to the left of the column (left-align) whereas values in the blue column are to the right of the column (right-align). Strings are usually left-aligned and numerics are right-aligned.

Yes, the language difference is that German(?) uses commas for decimal place delimiters whereas English uses dots for decimal place delimiters.

I am afraid I don't know whether it is possible to do this without the extra eval.

[ITWhisperer]

index=aida64_2
| timechart span=1m avg(CPU_power)

[LKrieger]

Hi ITWhisperer,

thanks for your fast reply. I tried your query but there seems something wrong.

It seems your query is right, but I dont know where the values come from. Arount 10000 per minute seems completely wrong. So in idle the System needs around 100Watt and there are around 20 entries per minute, which must leed in a value of 2000 per Minute. But I dont know where the 10000 are coming from now.

[ITWhisperer · Accepted solution]

It looks like CPU_power is not being treated as a numeric (it is left-aligned not right-aligned) which might explain why it is taking all 5 digits without a decimal place - possibly something to do with language settings?

index=aida64_2
| eval CPU_power=replace(CPU_power,",",".")
| timechart span=1m avg(CPU_power)