How to create search for CPU linux to load average?

[mm12]

Hi ,

I need the help to write splunk query for calculating CPU Linux load average for last 1,5 and 15 mins. I have splunk TA nix app and collected the metrics vmstat_metric.loadAvg1mi and used this metrics  for last 1 min query.  But I am not sure how to calculate the load average for last 5 and 15 mins. can anyone 

[gcusello]

Hi @mm12,

you have to categorize your data, using eval, something like this:

your_search
| eval period=case(_time<60,"1",_time<300,"2",_time<1500,"3")
| stats 
 avg(eval(if(_time<60,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_1m 
 avg(eval(if(_time<300,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_5m 
 avg(eval(if(_time<1500,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_15m

Ciao.

Giuseppe