How do you compare the average memory performance of 2 servers?

[mboiz]

Hi All,

Please help me create a query that compares cpu and memory with threshold performance in 1 month ( 4 data ) in 2 diff servers with a preview below

[Richfez]

You didn't provide any of your search so this is a lot harder. But hopefully...

index=blah host=HostA OR host=HostB
| eval MyThreshold=.8
| timechart avg(CPU_Percent) AS CPU, avg(MEM_Percent) AS Memory avg(MyThreshold) AS Threshold BY host

If you wanted extra fanciness, you could also use perc95(CPU_Percent) to get the 95th percentile, or max(), or ... any of the other statistical and charting functions.

Happy Splunking,
Rich

[Richfez]

Has this answer helped you solve your problem? If so, please "Accept" it so the next person stumbling across it in a search will know that this worked.

If this is still unresolved, please provide more information on what's not working.

If this is resolved and you've found another answer - great! Post that here as an answer, and go ahead and mark it as Accepted! It's OK to gather karma for yourself occasionally like that.

[mboiz]

Thank you rich,

that way is i want, but why the result is only threshold ? no avg preview
i want to create 2 data memory & cpu from 2 servers with result above

Thanks

[Richfez]

The result is only threshold probably because you didn't provide me with any information about your fields. So I made up names, like "CPU_Percent". You have to fill those in because I don't know what they are.

Your question and answers haven't made one thing clear - where are you at in this endeavor? Do you have Splunk installed, are you collecting performance metrics or CPU stats or whatever you need already?

[mboiz]

here my query

host="121" OR host="122" sourcetype="cpu"

| timechart eval(round(avg(PercentUserTime),0)."%") span=w by host
| eval threshold=90

but graph cant appear likes on attachment