Splunk Search

How to inject multiple host in the Splunk mstats?

microsac
Explorer

I am looking forward to creating a table for system metrics values like "cpu", "memory" and "swap", now if run the below search it works, but it will get all hosts available while I want my search to be specific to some hosts.
1)

| mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by host
| eval "cpu_active"=100-cpu_idle
| fillnull value=0
| foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)]


2)Where if i try like below then i get an error as i am beginner and not getting the right approach to get it .

| mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by 
("host"="host1.example.com" OR
"host"="host2.example.com" OR
"host"="host3.example.com"
)
| eval "cpu_active"=100-cpu_idle
| fillnull value=0
| foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)]

1) working screen shot 

microsac_0-1648626014925.png

2)  trial but not working 

microsac_1-1648626229017.png

Would appreciate to get any help or direction on this.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by host
| where host="host1.example.com" OR host="host2.example.com" OR host="host3.example.com"
| eval "cpu_active"=100-cpu_idle 
| fillnull value=0 
| foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)]

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by host
| where host="host1.example.com" OR host="host2.example.com" OR host="host3.example.com"
| eval "cpu_active"=100-cpu_idle 
| fillnull value=0 
| foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)]
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...