Splunk Search

How do I measure measuring wKB_PS across a four disk LUN with iostat?

belka
Path Finder

I have Netapp LUNS mapped to a Centos server. when I run iostat, I see all the individual disks that are mapped. I have three LUNs - for this purpose they are four disk LUNS: Lun1=(sda1, sda2, sda3, sda4), Lun2=(sda5, sda6, sda7, sda8) and Lun3=(sda9, sda10, sda11, sda12). I want to find the wKB_PS and rKB_PS to check the SAN performance. I wrote a search: index=os sourcetype=iostat host=databseservername | multikv | search Device="sda1" |time chart span=1m xax(wKB_PS) max(rKB_PS)
that works great on a single device/drive. How to I do four disk devices in one aggregated LUN?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I'm assuming you want to sum up the maximum read/write for a four-disk set?

... | search Device="sda1" OR Device="sda2" OR Device="sda3" OR Device="sda4" | timechart span=1m max(wKB_PS) max(rKB_PS) by Device | addtotals field=read *rKB_PS* | addtotals field=write *wKB_PS* | table _time read write

That should give you a timechart with two fields, read and write showing the sum over those four devices.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I'm assuming you want to sum up the maximum read/write for a four-disk set?

... | search Device="sda1" OR Device="sda2" OR Device="sda3" OR Device="sda4" | timechart span=1m max(wKB_PS) max(rKB_PS) by Device | addtotals field=read *rKB_PS* | addtotals field=write *wKB_PS* | table _time read write

That should give you a timechart with two fields, read and write showing the sum over those four devices.

martin_mueller
SplunkTrust
SplunkTrust

As it turns out the parameter is fieldname, not field 🙂

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/addtotals

0 Karma

belka
Path Finder

First - THANK YOU for the swift and very helpful response. There is just a wee bit of tweaking left, to get the LUN totals.

I get the following error message: Error in 'addtotals' command: Invalid argument: 'field=write'

I have tried is 'field = write' as well, same error message.

The search works up until the first 'addtotals' statement. Any thoughts?

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...