Splunk Search

How to create search for CPU linux to load average?

mm12
Explorer

Hi ,

I need the help to write splunk query for calculating CPU Linux load average for last 1,5 and 15 mins. I have splunk TA nix app and collected the metrics vmstat_metric.loadAvg1mi and used this metrics  for last 1 min query.  But I am not sure how to calculate the load average for last 5 and 15 mins. can anyone 

 

Tags (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mm12,

you have to categorize your data, using eval, something like this:

your_search
| eval period=case(_time<60,"1",_time<300,"2",_time<1500,"3")
| stats 
 avg(eval(if(_time<60,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_1m 
 avg(eval(if(_time<300,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_5m 
 avg(eval(if(_time<1500,vmstat_metric.loadAvg,"") AS vmstat_metric.loadAvg_15m

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...