Splunk Search

How to display load average values in a chart?

rajgowd1
Communicator

Hi,
i have written script which extracts the load average values and provides the output.by using below output, how can we create charts to display load average?

0 Karma
1 Solution

gokadroid
Motivator

Since there is no time given in the sample so I will guess it. Let's say if load averages are being calculated at discrete intervals, i.e. the 15 min average does not have data included from the 5 minute average, and 5 minute average doesn't have 1 minute average in it, then if each "output" line is a single event the intuitive graph that becomes is:

index=yourIndex sourcetype=yourSourcetype loadaverage
| rex "value=\"(?<loadAvg>[^\"]+)\""
| timechart max(loadAvg) as LoadAvg

From the visualization options choose Format >> General >> Null Values as Connect to ensure the average stays continuous in case of missing values . That shall form the basic timechart at least to start off. Alternatively you can use min function in timechart.

View solution in original post

0 Karma

gokadroid
Motivator

Since there is no time given in the sample so I will guess it. Let's say if load averages are being calculated at discrete intervals, i.e. the 15 min average does not have data included from the 5 minute average, and 5 minute average doesn't have 1 minute average in it, then if each "output" line is a single event the intuitive graph that becomes is:

index=yourIndex sourcetype=yourSourcetype loadaverage
| rex "value=\"(?<loadAvg>[^\"]+)\""
| timechart max(loadAvg) as LoadAvg

From the visualization options choose Format >> General >> Null Values as Connect to ensure the average stays continuous in case of missing values . That shall form the basic timechart at least to start off. Alternatively you can use min function in timechart.

0 Karma

rajgowd1
Communicator

thank you for your response.

0 Karma

rajgowd1
Communicator

can we show values in single line like below

0.00,0.20,10.00

0 Karma

gokadroid
Motivator

you might want to explore the transpose option, something like:

index=yourIndex sourcetype=yourSourcetype loadaverage
| rex "value=\"(?<loadAvg>[^\"]+)\""
| table loadAvg
| transpose
0 Karma

somesoni2
Revered Legend

YOu may be missing the output that you wanted to show.

0 Karma

rajgowd1
Communicator

somehow i am not able to copy entire output,i copied single line
but here is the last column from the out put

name="loadaverage|last1min" value="0.00"
name="loadaverage|last5min" value="0.34"/>
name="loadaverage|last15min" value="5.00"/>

0 Karma

rajgowd1
Communicator

sorry here is the output

system time="Thu Jan 19 20:24:50 2017" HostName ="gpd-653-fc88" Days ="76" Users ="2" name="loadaverage|last1min" value="0.00"/>

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...