Is there a good way to chart the value of a field by the value of another field?
That is... I'm using the Splunk for *nix app, performing a search on that data. Setting my source="cpu". Want to extract out pctIdle by CPU core. I can do it pretty easily for each individual core with something like this:
index=os source="cpu" host="host1" | multikv fields cpu | search CPU="1" |table pctIdle
but what I really want to do is have a multi column table with that value in real-time by cpu core (and eventually, a visualization by column).
Thank you for your help!
If I'm thinking straight this morning, you would want to use stats.
index=os source="cpu" host="host1" | multikv fields cpu |stats latest(pctIdle) as "Percent Idle" by cpu
If I'm thinking straight this morning, you would want to use stats.
index=os source="cpu" host="host1" | multikv fields cpu |stats latest(pctIdle) as "Percent Idle" by cpu
Glad it worked for you! Please accept the answer when you have time!
Perfect. Thank you much!
After your pastebin, it seems as if the fields aren't auto extracted (at least in my instance). Try this: |multikv|rex field=_raw "^(?<cpu>\d+)\s*(?<pctUser>[^\s]*)\s*(?<pctNice>[^\s]*)\s*(?<pctSystem>[^\s]*)\s*(?<pctIowait>[^\s]*)\s*(?<pctIdle>[^\s]*)"|eval pctCPUUsed = 100-pctIdle| stats latest(pctCPUUsed) by cpu
It doesn't seem to be working, but maybe that's the right track. Let me play with it a bit and I'll post again...