- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to graph timechart of top 5 processes for ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All. If the user selects %_Processor_Time,then I need to show the graph for avg(%_Processor_Time) for top 5 processes that consumes %_Processor_Time. I got the top 5 processes using the search but unable to write the timechart command in the same query to display graph.
index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" | eval Process=upper(instance) | table Process %_Processor_Time | sort - %_Processor_Time | dedup Process | head 5
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Throw it all into a subsearch that returns the processes, then run your timechart command in the outer search:
index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" [search index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" | eval Process=upper(instance) | table Process %_Processor_Time | sort - %_Processor_Time | dedup Process | head 5 | fields Process] | timechart avg(%_Processor_Time) by Process
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Throw it all into a subsearch that returns the processes, then run your timechart command in the outer search:
index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" [search index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" | eval Process=upper(instance) | table Process %_Processor_Time | sort - %_Processor_Time | dedup Process | head 5 | fields Process] | timechart avg(%_Processor_Time) by Process
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks I used the same and its working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can anyone please help me on this?
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
