Splunk Search
Highlighted

How to edit my search to aggregate the values from all disks in a single value and display a line representing IOPS from these disks?

Explorer

Hi folks,
I'm using the following search to display a graph with the disk throughput (IOPS) for every disk in a host:

index="os" source="iostat" host="splunk" | timechart span=5m avg(total_ops) by Device

alt text

But I don't know how to aggregate the values from all disks in a single value and display only a line with all the IOPS from all disks.

Any suggestion would be appreciated.

Thanks!
Jorge.

0 Karma
Highlighted

Re: How to edit my search to aggregate the values from all disks in a single value and display a line representing IOPS from these disks?

SplunkTrust
SplunkTrust

How about this

index="os" source="iostat" host="splunk" | timechart span=5m avg(total_ops) by Device | addtotals fieldname=IOPS | table _time IOPS 

View solution in original post

Highlighted

Re: How to edit my search to aggregate the values from all disks in a single value and display a line representing IOPS from these disks?

Explorer

Great, this is exactly what I was looking for! Thanks for your help!

0 Karma
Highlighted

Re: How to edit my search to aggregate the values from all disks in a single value and display a line representing IOPS from these disks?

Legend

Could you please clarify whether you want to see total of IOPS for all devices or average of all IOPS? If possible with dummy data examples as table. I would expect sum() and max() as the stats to be used in the following case instead of average unless if that is what you want to show for all IOPS by Devices.

Following will show single TotalIOPS line on top of your existing series.

index="os" source="iostat" host="splunk" |  eventstats max(total_ops) as Total   | timechart span=5m max(total_ops) as Max max(Total) as Total by Device |fields - "Total: sdb" "Total: sdc" | rename "Total: sda" as Total 

 | <use fields -  to remove other Total fields> | <rename one of the Total field as per your need>

Finally, create Chart Overlay with Total series.

If you want to perform overall average then you can use avg(totalops) instead of sum(totalops).




| eval message="Happy Splunking!!!"


0 Karma