Is there a good way to chart the value of a field by the value of another field?

[shaun_qualheim]

Is there a good way to chart the value of a field by the value of another field?

That is... I'm using the Splunk for *nix app, performing a search on that data. Setting my source="cpu". Want to extract out pctIdle by CPU core. I can do it pretty easily for each individual core with something like this:

index=os source="cpu" host="host1" | multikv fields cpu | search CPU="1" |table pctIdle

but what I really want to do is have a multi column table with that value in real-time by cpu core (and eventually, a visualization by column).

Thank you for your help!

[alacercogitatus · Accepted solution]

If I'm thinking straight this morning, you would want to use stats.

index=os source="cpu" host="host1" | multikv fields cpu |stats latest(pctIdle) as "Percent Idle" by cpu

[alacercogitatus]

Glad it worked for you! Please accept the answer when you have time!

[shaun_qualheim]

Perfect. Thank you much!

[alacercogitatus]

After your pastebin, it seems as if the fields aren't auto extracted (at least in my instance). Try this: |multikv|rex field=_raw "^(?<cpu>\d+)\s*(?<pctUser>[^\s]*)\s*(?<pctNice>[^\s]*)\s*(?<pctSystem>[^\s]*)\s*(?<pctIowait>[^\s]*)\s*(?<pctIdle>[^\s]*)"|eval pctCPUUsed = 100-pctIdle| stats latest(pctCPUUsed) by cpu

[shaun_qualheim]

It doesn't seem to be working, but maybe that's the right track. Let me play with it a bit and I'll post again...