Splunk Search

Metrics in chart

sizemorejm
Explorer

I am trying to use a radial gauge graph in order to show a % using avg(cpu_metric.Idle). However, I want the "reverse" value of the cpu_metric.Idle. So what I am attempting to do is

| mstats .................. hostname.......... | chart count(eval( 100 - avg(cpu_metric.Idle)) as name

 

Basically I am trying to show " 100 - avg(cpu_metric.Idle)" on a gauge and the only way for me to get the new value is doing "  | chart avg(cpu_metric.Idle) as name | eval new = 100 - name "  but I cant put the eval value onto a chart. 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Now sure why you cannot put the eval value onto a chart, but chart may not be necessary.  There are multiple ways to do this.  If you want to use chart command after mstats, do this

| mstats avg(cpu_metric.Idle) as cpu_metric.Idle where .................. hostname..........
| chart values(eval( 100 - cpu_metric.Idle)) as name

 Alternatively, and perhaps slightly more efficiently, you can do simple eval

| mstats avg(cpu_metric.Idle) as name where .................. hostname..........
| eval name = 100 - name
0 Karma

sizemorejm
Explorer

For both set, I get an error saying "No results found. Try expanding the time range.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Then it's a question about your data source.  Are you sure metric cpu_metric.Idle exists?  Do you know which index (indices) is(are) metrics index/indices?  Forget that remainder.  What does this give you?

| mstats avg(cpu_metric.Idle) as name where index=my_metrics_index

If this also has no result, examine your data source deeper.

| mstats avg(cpu_metric.Idle) as name where index=my_metrics_index​
| foreach *
    [eval metrics = mvappend(metrics, "<<FIELD>>")]
| table metrics

Do you have any metrics index at all?  In fact, why did you show an invalid mstats command in the original description?  I'm just trying to follow your original logic.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...