Splunk Search

How to edit my search to aggregate the values from all disks in a single value and display a line representing IOPS from these disks?

jorgefg
Explorer

Hi folks,
I'm using the following search to display a graph with the disk throughput (IOPS) for every disk in a host:

index="os" source="iostat" host="splunk" | timechart span=5m avg(total_ops) by Device

alt text

But I don't know how to aggregate the values from all disks in a single value and display only a line with all the IOPS from all disks.

Any suggestion would be appreciated.

Thanks!
Jorge.

0 Karma
1 Solution

somesoni2
Revered Legend

How about this

index="os" source="iostat" host="splunk" | timechart span=5m avg(total_ops) by Device | addtotals fieldname=IOPS | table _time IOPS 

View solution in original post

niketn
Legend

Could you please clarify whether you want to see total of IOPS for all devices or average of all IOPS? If possible with dummy data examples as table. I would expect sum() and max() as the stats to be used in the following case instead of average unless if that is what you want to show for all IOPS by Devices.

Following will show single TotalIOPS line on top of your existing series.

index="os" source="iostat" host="splunk" |  eventstats max(total_ops) as Total   | timechart span=5m max(total_ops) as Max max(Total) as Total by Device |fields - "Total: sdb" "Total: sdc" | rename "Total: sda" as Total 

 | <use fields -  to remove other Total fields> | <rename one of the Total field as per your need>

Finally, create Chart Overlay with Total series.

If you want to perform overall average then you can use avg(total_ops) instead of sum(total_ops).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

How about this

index="os" source="iostat" host="splunk" | timechart span=5m avg(total_ops) by Device | addtotals fieldname=IOPS | table _time IOPS 

jorgefg
Explorer

Great, this is exactly what I was looking for! Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...