Splunk Search

How to display CPU stats by host, add all transactions from each server's logfile, and have that sum overlaying the CPU area graph?


I'm creating what at first seemed a simple search criteria, but here goes...
I have multiple servers and displaying CPU by host, but also scanning each server's log file for transaction numbers. I need to display the CPU stats by host, but add all the transactions and have that sum overlaying the CPU area graph.
Hope you're still with me and here is my code so far (sanitized)...

index=os OR index= (sourcetype=cpu OR sourcetype=)  host= source=/opt/ OR TXN="Elapsed time for this payment" | multikv fields pctSystem | timechart span=5m count(TXN) avg(pctSystem)

Cheers Splunkers

0 Karma


Hi rob3770
Try this search code

host=* sourcetype=* TXN="Elapsed time for this payment" |transaction  CPU host  maxspan=7m  |timechart count(CPU) by host  span=5m

Enter in search bar and save it as dashboard , and go to visualisation app select area . For obtaining area graph.

0 Karma


Im now running this...

index=os OR index=wpg (sourcetype=cpu OR sourcetype=our_java) host=servername* "Elapsed time for this payment" NOT "HealthCheck" | transaction CPU host maxspan=7m | timechart count(cpu) by host span=5m

Thousands of Events are found and highlighted "Elapsed time for this payment" but the Statistics tab is showing zeros.
Sourcetype=cpu isnt found either, only Sourcetype=our_java.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...