Splunk Search

Finding additional info about a value returned by max

cphair
Builder

I am looking at maximum processor usage by specific processes on a group of clients. By using stats max on my data (which contains host, instance, and % Processor Time fields), I can pull the max % Processor time that a given process reached on any client in the group. Is there a way to get Splunk to tell me which host (or record) that maximum came from? Ideally I'd like to be able to mouse over the entry in a bar graph and have it tell me something like "iexplore: 99%, host: foo1".

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Yes, you can do this using the "sort" command, supposing the processor time is in a field called % Processor Time:

... | sort - "% Processor Time" | head 1 | table host instance "% Processor Time"

Now, you can make this more interesting by looking at the top per host:

... | dedup host sortby - "% Processor Time" | table host instance "% Processor Time"

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

Yes, you can do this using the "sort" command, supposing the processor time is in a field called % Processor Time:

... | sort - "% Processor Time" | head 1 | table host instance "% Processor Time"

Now, you can make this more interesting by looking at the top per host:

... | dedup host sortby - "% Processor Time" | table host instance "% Processor Time"

cphair
Builder

I used stats to split out the max by each host and instance, then used eval to create a new field (eval hostInstance = instance . ":" . host), then displayed the max value with the conjoined field. Inelegant but functional.

I think this is the way to go, though:


...| stats max(Value) as Max by instance,host | dedup instance sortby -Max

Still have to mess with numbered instances and case-sensitivity, but it's less ugly. Also, if you want to keep the top X readings per instance instead of the top 1, you can say "dedup X instance sortby -Max".

0 Karma

richprescott
Path Finder

What was the other way that you ended up using?

0 Karma

cphair
Builder

I ended up doing this another way, but I think this works too, so I'll mark it up. Thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...