Hi, all, I am a newbie in splunk. I have encounter a problem when play around with *NIX app in Splunk. I am going to calculate the total CPU usage in each minutes
PID USER PR NI VIRT RES SHR S pctCPU pctMEM cpuTIME COMMAND
32206 root 15 0 298m 129m 10m S 19.3 0.8 15:46.08 splunkd
14559 root 15 0 13016 1224 708 R 3.9 0.0 0:00.03 top
1 root 15 0 10348 684 576 S 0.0 0.0 0:04.85 init
2 root RT -5 0 0 0 S 0.0 0.0 0:00.08 migration/0
3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 root RT -5 0 0 0 S 0.0 0.0 0:00.13 migration/1
6 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1
7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1
I don't know how to extract the pctCPU value. Any hint?
Thank you.
Regards, Alister
The multikv
command helps you to split the tabular formatted events in to separate ones.
You can use a query like this:
sourcetype=ps | multikv | stats sum(pctCPU) as sumPctCPU by _time,host | timechart span=1m avg(sumPctCPU) by host