Splunk Search

How to build a timechart that shows overall (n+1) capacity and per site visibility?

burras
Communicator

I'm attempting to develop a chart for one of my engineering teams that shows peak utilization across multiple sites over a given timeframe with an overlay showing (n+1) capacity. That part was easy enough to build:

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval "(n+1) Capacity" = 80

The issue has come in where they no longer want a static capacity line. They are adding new nodes to the system and want the (n+1) capacity line to change automatically to account for new node adds but also reflect when changes were made in the past (i.e. if there are 4 nodes today then capacity=80, when they add a node tomorrow capacity becomes 83). After several iterations of playing around, I've been able to get it to calculate the right capacity line but can only get it to display overall max utilization, not broken down by site:

index=foo sourcetype=bar Site!=Other | stats max(util), dc(Site) as n by _time |eval capacity=(n/(n+1)*100) |fields - n

Any advice on how to format this in order to display the capacity line for all Sites over time along with the max utilization per Site?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,n+1) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

Updated

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,if('<<FIELD>>'>0,n+1,n)) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

View solution in original post

somesoni2
Revered Legend

Give this a try

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,n+1) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

Updated

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,if('<<FIELD>>'>0,n+1,n)) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

View solution in original post

burras
Communicator

Beautiful, that updated answer was the one. Appreciate the help!

0 Karma

burras
Communicator

That mostly works - it breaks out each Site's max utilization individual but it doesn't show the change in capacity over time. It just shows the "(n+1) Capacity" as a static line over the searched timeframe instead of changing when the count of nodes changes.

0 Karma

burras
Communicator

To clarify - the n+1 capacity line that it shows over the whole searched period is that last n+1 data for the period instead of showing 66 when I have 3 nodes, 80 when I have 4 nodes, 83 when I have 5 nodes. This would be cake if the eval command allowed you to use dc(Site) as part of the command 🙂

0 Karma

somesoni2
Revered Legend

Try the updated answer.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.