Splunk Search

How to inject multiple host in the Splunk mstats?

microsac
Explorer

I am looking forward to creating a table for system metrics values like "cpu", "memory" and "swap", now if run the below search it works, but it will get all hosts available while I want my search to be specific to some hosts.
1)

| mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by host
| eval "cpu_active"=100-cpu_idle
| fillnull value=0
| foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)]


2)Where if i try like below then i get an error as i am beginner and not getting the right approach to get it .

| mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by 
("host"="host1.example.com" OR
"host"="host2.example.com" OR
"host"="host3.example.com"
)
| eval "cpu_active"=100-cpu_idle
| fillnull value=0
| foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)]

1) working screen shot 

microsac_0-1648626014925.png

2)  trial but not working 

microsac_1-1648626229017.png

Would appreciate to get any help or direction on this.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by host
| where host="host1.example.com" OR host="host2.example.com" OR host="host3.example.com"
| eval "cpu_active"=100-cpu_idle 
| fillnull value=0 
| foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)]

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by host
| where host="host1.example.com" OR host="host2.example.com" OR host="host3.example.com"
| eval "cpu_active"=100-cpu_idle 
| fillnull value=0 
| foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)]
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...