How can I get a load average of cpu using splunk query?

[udaymadupathi]

I am seeing 3 load average values, need to get a query to get 3 values and get an average.

[DalJeanis · Accepted solution]

Okay, given your data format, I don't think that multikv is going to properly extract your data. multikv is designed to get columnar data, ( see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multikv) and this data looks nothing like that.

Try this...

 index="osw" host="ausilsoaapp49.us.dell.com" sourcetype="oswtop"
| rex "load average:\s*(?<load1>[\d\.]*),\s*(?<load2>[\d\.]*),\s*(?<load3>[\d\.]*)"
| fillnull value=0 load1 load2 load3
| eval LoadAverage =  round((load1+load2+load3)/3,2)

[udaymadupathi]

index="osw" host="ausilsoaapp49.us.dell.com" sourcetype="oswtop"| multikv fields load average |   (?[\d.]+), (?[\d.]+), (?[\d.]+) |stats avg("Total load avg time") as "Average load avg"

top - 11:55:37 up 15 days, 20:56,  0 users,  load average: 4035.66, 4033.69, 403
Tasks: 4315 total,   1 running, 4314 sleeping,   0 stopped,   0 zombie
%Cpu(s):  6.2 us,  7.3 sy,  0.0 ni, 86.3 id,  0.0 wa,  0.0 hi,  0.2 si,  0.0 st
KiB Mem : 16260328 total,   931420 free, 12506104 used,  2822804 buff/cache
KiB Swap:  2097148 total,  2097148 free,        0 used.  2042484 avail Mem 

[kmaron]

please provide the query you are using and a sample event of your data so we can help you