Splunk Search

How to build a timechart that shows overall (n+1) capacity and per site visibility?

Communicator

I'm attempting to develop a chart for one of my engineering teams that shows peak utilization across multiple sites over a given timeframe with an overlay showing (n+1) capacity. That part was easy enough to build:

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval "(n+1) Capacity" = 80

The issue has come in where they no longer want a static capacity line. They are adding new nodes to the system and want the (n+1) capacity line to change automatically to account for new node adds but also reflect when changes were made in the past (i.e. if there are 4 nodes today then capacity=80, when they add a node tomorrow capacity becomes 83). After several iterations of playing around, I've been able to get it to calculate the right capacity line but can only get it to display overall max utilization, not broken down by site:

index=foo sourcetype=bar Site!=Other | stats max(util), dc(Site) as n by _time |eval capacity=(n/(n+1)*100) |fields - n

Any advice on how to format this in order to display the capacity line for all Sites over time along with the max utilization per Site?

0 Karma
1 Solution

Revered Legend

Give this a try

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,n+1) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

Updated

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,if('<<FIELD>>'>0,n+1,n)) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

View solution in original post

Revered Legend

Give this a try

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,n+1) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

Updated

index=foo sourcetype=bar Site!=Other | timechart max(util) by Site | eval n=0 | foreach * [eval n=if("<<FIELD>>"="_time" OR "<<FIELD>>"="n" ,n,if('<<FIELD>>'>0,n+1,n)) ] | eval "(n+1) Capacity" = (n/(n+1)*100) | fields - n

View solution in original post

Communicator

Beautiful, that updated answer was the one. Appreciate the help!

0 Karma

Communicator

That mostly works - it breaks out each Site's max utilization individual but it doesn't show the change in capacity over time. It just shows the "(n+1) Capacity" as a static line over the searched timeframe instead of changing when the count of nodes changes.

0 Karma

Communicator

To clarify - the n+1 capacity line that it shows over the whole searched period is that last n+1 data for the period instead of showing 66 when I have 3 nodes, 80 when I have 4 nodes, 83 when I have 5 nodes. This would be cake if the eval command allowed you to use dc(Site) as part of the command 🙂

0 Karma

Revered Legend

Try the updated answer.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!