Splunk Search

Finding additional info about a value returned by max

cphair
Builder

I am looking at maximum processor usage by specific processes on a group of clients. By using stats max on my data (which contains host, instance, and % Processor Time fields), I can pull the max % Processor time that a given process reached on any client in the group. Is there a way to get Splunk to tell me which host (or record) that maximum came from? Ideally I'd like to be able to mouse over the entry in a bar graph and have it tell me something like "iexplore: 99%, host: foo1".

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Yes, you can do this using the "sort" command, supposing the processor time is in a field called % Processor Time:

... | sort - "% Processor Time" | head 1 | table host instance "% Processor Time"

Now, you can make this more interesting by looking at the top per host:

... | dedup host sortby - "% Processor Time" | table host instance "% Processor Time"

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

Yes, you can do this using the "sort" command, supposing the processor time is in a field called % Processor Time:

... | sort - "% Processor Time" | head 1 | table host instance "% Processor Time"

Now, you can make this more interesting by looking at the top per host:

... | dedup host sortby - "% Processor Time" | table host instance "% Processor Time"

cphair
Builder

I used stats to split out the max by each host and instance, then used eval to create a new field (eval hostInstance = instance . ":" . host), then displayed the max value with the conjoined field. Inelegant but functional.

I think this is the way to go, though:


...| stats max(Value) as Max by instance,host | dedup instance sortby -Max

Still have to mess with numbered instances and case-sensitivity, but it's less ugly. Also, if you want to keep the top X readings per instance instead of the top 1, you can say "dedup X instance sortby -Max".

0 Karma

richprescott
Path Finder

What was the other way that you ended up using?

0 Karma

cphair
Builder

I ended up doing this another way, but I think this works too, so I'll mark it up. Thanks.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...