Splunk Search

How to calculate max 3 cpu usage each day and when ran for last 7 days, It should show 21 max CPU usage

tarunmalhotra79
Engager

The idea is to show up top 3 CPU Averages in a day for last 7 days.

Query Using:-
index=os sourcetype=ps host="Host1"
| timechart span=1h avg(pctCPU) as Avg_pctCPU

Here, I want to first sort the result and then using the limit command filter only top 3 results with maximum value for each day and then if i run the search for last 7 days then it should do the same thing and should give me the 21 results,

Top 3 results each day * 7 days. == Total 21 results

Thanks in advance

Tags (2)
0 Karma
1 Solution

manjunathmeti
Champion

Hi @tarunmalhotra792,

Try this:

index=os sourcetype=ps host="Host1"
| timechart span=1h avg(pctCPU) as Avg_pctCPU
| bin _time span=1d
| top 3 Avg_pctCPU by _time

View solution in original post

0 Karma

manjunathmeti
Champion

Hi @tarunmalhotra792,

Try this:

index=os sourcetype=ps host="Host1"
| timechart span=1h avg(pctCPU) as Avg_pctCPU
| bin _time span=1d
| top 3 Avg_pctCPU by _time
0 Karma

tarunmalhotra79
Engager

Thanks, It worked

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...