Splunk Search

How to create search for CPU linux to load average?

mm12
Explorer

Hi ,

I need the help to write splunk query for calculating CPU Linux load average for last 1,5 and 15 mins. I have splunk TA nix app and collected the metrics vmstat_metric.loadAvg1mi and used this metrics  for last 1 min query.  But I am not sure how to calculate the load average for last 5 and 15 mins. can anyone 

 

Tags (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mm12,

you have to categorize your data, using eval, something like this:

your_search
| eval period=case(_time<60,"1",_time<300,"2",_time<1500,"3")
| stats 
 avg(eval(if(_time<60,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_1m 
 avg(eval(if(_time<300,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_5m 
 avg(eval(if(_time<1500,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_15m

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...