Splunk Search

Filtering mstats data using eventtypes and tags

johnward4
Communicator

I'm looking for help to filter my mstats data using eventtype OR tag I've created for groups of hosts..

Here's an example of my CPU metrics dashboard panel 

 

| mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT host=$host$ groupby metric_name, host span=1m
| `def_cpu_load_percent` | timechart `nmon_span` avg(cpu_load_percent) AS cpu_load_percent by host useother=false

 

 

I've tried appending a non-metrics subsearch to search against the metric data using my tag AND host so that only the selected hosts return in my panel 

 

index = example_index (eventtype=test1 OR eventtype=test2 OR eventtype=test3)
| search (host=* AND tag = test2) 
| append 
[ | mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT host=dac51elo.pjm.com groupby metric_name, host span=1m
| `def_cpu_load_percent` ] | timechart `nmon_span` avg(cpu_load_percent) AS cpu_load_percent by host useother=false

 

Labels (2)
Tags (2)
0 Karma