I have my apache servers' mod_status output (/server-status?auto) being pulled into Splunk with a scripted input. The CPU usage of apache is its own field in the search results as a numeric value. Problem is the apache servers use less that 1% of CPU when things are normal so the data being pulled into Splunk shows up like
Whenever I run a simple search like:
sourcetype=access_combined | timechart span=1m sum(apache_cpu_used) by ServerName
I don't get any results in the visualization. Tried changing the Y axis value minimum to be .05 and still nothing. My guess is Splunk doesn't like the 0 missing before the decimal. Since the value will show up when apache uses more than 1% CPU it's correct the way it's being input. What's the best way to get Splunk to evaluate the data with missing leading digits or am I just missing something?
Test this
sourcetype=access_combined
| eval apache_cpu_used_numeric=tonumber(apache_cpu_used)
| timechart span=1m sum(apache_cpu_used_numeric) by ServerName
If that doesn't work, it may be that the tonumber
function doesn't like the missing 0. Then you can try
sourcetype=access_combined
| eval apache_cpu_used_numeric=tonumber("0" . apache_cpu_used)
| timechart span=1m sum(apache_cpu_used_numeric) by ServerName
If you run these searches in Verbose mode, you should be able to see the fields and events even if the timechart doesn't work. Finally, if this solves your problem, you could create a calculated field that makes the numeric conversion for you automatically.
Test this
sourcetype=access_combined
| eval apache_cpu_used_numeric=tonumber(apache_cpu_used)
| timechart span=1m sum(apache_cpu_used_numeric) by ServerName
If that doesn't work, it may be that the tonumber
function doesn't like the missing 0. Then you can try
sourcetype=access_combined
| eval apache_cpu_used_numeric=tonumber("0" . apache_cpu_used)
| timechart span=1m sum(apache_cpu_used_numeric) by ServerName
If you run these searches in Verbose mode, you should be able to see the fields and events even if the timechart doesn't work. Finally, if this solves your problem, you could create a calculated field that makes the numeric conversion for you automatically.