Splunk Search

It is possible to use a variable under mstats search?

soulmaker
Explorer

Hi there, 

I am trying to make a statistic graph in my dashboard using the search below.  

| mstats rate(vault.runtime.total_gc_pause_ns.value) as gc_pause WHERE `vault_telemetry` AND cluster=* AND (host=*) BY host span=5m
| timechart max(gc_pause) AS iowait bins=1000 BY host
| eval warning=3.3e7, critical=8.3e7

**Note that the search below comes from the pre-defined dashboard template but it is not working as is in my environment. 

In my Splunk, when I do a mpreview of my index `vault_telemetry` I am getting a result like the below:

metric_name:vault.hostname1.runtime.total_gc_pause_ns
metric_name:vault.hostname2.runtime.total_gc_pause_ns
metric_name:vault.hostname3.runtime.total_gc_pause_ns
metric_name:vault.hostname3.runtime.total_gc_pause_ns
metric_name:vault.hostname4.runtime.total_gc_pause_ns

If I modify the pre-defined search from the template using the below I can get the result however, I can only do it on one hostname. 

| mstats rate(vault.hostname1.runtime.total_gc_pause_ns) as gc_pause WHERE `vault_telemetry` span=5m
| timechart max(gc_pause) AS iowait bins=1000
| eval warning=3.3e7, critical=8.3e7

 

I would like to have all the hostname shows on my single panel. Can someone please able to assist and help me with the correct search index I need to use?

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If I understood correctly, just use wildcards

| mstats rate(vault.hostname*.runtime.total_gc_pause_ns) as gc_pause_* WHERE `vault_telemetry` span=5m
| timechart max(gc_pause_*) AS iowait_* bins=1000
| eval warning=3.3e7, critical=8.3e7

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

If I understood correctly, just use wildcards

| mstats rate(vault.hostname*.runtime.total_gc_pause_ns) as gc_pause_* WHERE `vault_telemetry` span=5m
| timechart max(gc_pause_*) AS iowait_* bins=1000
| eval warning=3.3e7, critical=8.3e7

 

soulmaker
Explorer

Your a real legend @bowesmana . I didn't realize that you can put wildcards in the middle. Thank you so much for your help. I am new to Splunk so your help is really helpful. 

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...