How to edit my search to aggregate the values from all disks in a single value and display a line representing IOPS from these disks?

[jorgefg]

Hi folks,
I'm using the following search to display a graph with the disk throughput (IOPS) for every disk in a host:

index="os" source="iostat" host="splunk" | timechart span=5m avg(total_ops) by Device

But I don't know how to aggregate the values from all disks in a single value and display only a line with all the IOPS from all disks.

Any suggestion would be appreciated.

Thanks!
Jorge.

[niketn]

Could you please clarify whether you want to see total of IOPS for all devices or average of all IOPS? If possible with dummy data examples as table. I would expect sum() and max() as the stats to be used in the following case instead of average unless if that is what you want to show for all IOPS by Devices.

Following will show single TotalIOPS line on top of your existing series.

index="os" source="iostat" host="splunk" |  eventstats max(total_ops) as Total   | timechart span=5m max(total_ops) as Max max(Total) as Total by Device |fields - "Total: sdb" "Total: sdc" | rename "Total: sda" as Total 

 | <use fields -  to remove other Total fields> | <rename one of the Total field as per your need>

Finally, create Chart Overlay with Total series.

If you want to perform overall average then you can use avg(total_ops) instead of sum(total_ops).

[somesoni2 · Accepted solution]

How about this

index="os" source="iostat" host="splunk" | timechart span=5m avg(total_ops) by Device | addtotals fieldname=IOPS | table _time IOPS 

[jorgefg]

Great, this is exactly what I was looking for! Thanks for your help!