Splunk Search

How can I get the result ?

flzhang132
Explorer

How can I get the result ? thanks !
alt text

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@flzhang132,

Try this and let's know

index="your index" "other search terms"
|eval time=strftime(_time,"%d/%m/%Y")
|fields time,type,host,device,metric_value| fillnull value="NA"
|stats avg(eval(if(type="cpu",metric_value,null()))) as cpu,
  avg(eval(if(type="mem",metric_value,null()))) as mem,
  avg(eval(if(device="/dev/vda1",metric_value,null()))) as diskusage1,
  avg(eval(if(device="/dev/vdb",metric_value,null()))) as diskusage2,
  values(host) as host,values(time) as time by type,device
|fields - type,device|replace NA with ""

Sorry not tested.

Happy Splunking!

View solution in original post

0 Karma

flzhang132
Explorer

alt text

0 Karma

somesoni2
Revered Legend

How frequently do you collect these metrics for each host?

0 Karma

flzhang132
Explorer

yes , there are many hosts ,and each hosts have vary of device metrics

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@flzhang132,

Try this and let's know

index="your index" "other search terms"
|eval time=strftime(_time,"%d/%m/%Y")
|fields time,type,host,device,metric_value| fillnull value="NA"
|stats avg(eval(if(type="cpu",metric_value,null()))) as cpu,
  avg(eval(if(type="mem",metric_value,null()))) as mem,
  avg(eval(if(device="/dev/vda1",metric_value,null()))) as diskusage1,
  avg(eval(if(device="/dev/vdb",metric_value,null()))) as diskusage2,
  values(host) as host,values(time) as time by type,device
|fields - type,device|replace NA with ""

Sorry not tested.

Happy Splunking!
0 Karma

flzhang132
Explorer

device="/dev/vda1 or device="/dev/vdb2 or device="/dev/sdb1 ...... and so on
so can not used to if(device="/dev/vda1",metric_value,null())
I want to find rank...over() like oracle

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

The above is exactly to match your requirement. The easy solution is

 index="your index" "other search terms"
 |eval time=strftime(_time,"%d/%m/%Y")
 |fields time,type,host,device,metric_value| fillnull value="NA"
 |stats avg(metric_value) as metric_value , values(host) as host,values(time) as time by type,device
 |replace NA with ""

and you could use chart func(value) over something by this

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...