How do I measure measuring wKB_PS across a four disk LUN with iostat?

[belka]

I have Netapp LUNS mapped to a Centos server. when I run iostat, I see all the individual disks that are mapped. I have three LUNs - for this purpose they are four disk LUNS: Lun1=(sda1, sda2, sda3, sda4), Lun2=(sda5, sda6, sda7, sda8) and Lun3=(sda9, sda10, sda11, sda12). I want to find the wKB_PS and rKB_PS to check the SAN performance. I wrote a search: index=os sourcetype=iostat host=databseservername | multikv | search Device="sda1" |time chart span=1m xax(wKB_PS) max(rKB_PS)
that works great on a single device/drive. How to I do four disk devices in one aggregated LUN?

[martin_mueller · Accepted solution]

I'm assuming you want to sum up the maximum read/write for a four-disk set?

... | search Device="sda1" OR Device="sda2" OR Device="sda3" OR Device="sda4" | timechart span=1m max(wKB_PS) max(rKB_PS) by Device | addtotals field=read *rKB_PS* | addtotals field=write *wKB_PS* | table _time read write

That should give you a timechart with two fields, read and write showing the sum over those four devices.

[martin_mueller]

As it turns out the parameter is fieldname, not field 🙂

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/addtotals

[belka]

First - THANK YOU for the swift and very helpful response. There is just a wee bit of tweaking left, to get the LUN totals.

I get the following error message: Error in 'addtotals' command: Invalid argument: 'field=write'

I have tried is 'field = write' as well, same error message.

The search works up until the first 'addtotals' statement. Any thoughts?