Solved: Re: Need Help with query - Splunk Community

Splunk Search

Trying build a time chart for Top 10 CPU consuming Processes for a Linux host for a given timeframe.

index=os host=xxxxxx source=top pctCPU != 0.0 
| table COMMAND, pctCPU _time | sort - pctCPU | dedup COMMAND | head 10

I am trying to get a timechart based for the pctCPU usage only for these 10 COMMANDS.

Thanks

1 Solution

Solution

You could try something like this

index=os host=xxxxxx source=top pctCPU != 0.0 
| fields COMMAND, pctCPU _time 
| eventstats max(pctCPU) as maxpctCPU by COMMAND
| sort - maxpctCPU COMMAND
| streamstats dc(COMMAND) as rank
| where rank <= 10
| fields - rank maxpctCPU
| timechart span=1h max(pctCPU) as maxpctCPU by COMMAND

View solution in original post

Solution

You could try something like this

index=os host=xxxxxx source=top pctCPU != 0.0 
| fields COMMAND, pctCPU _time 
| eventstats max(pctCPU) as maxpctCPU by COMMAND
| sort - maxpctCPU COMMAND
| streamstats dc(COMMAND) as rank
| where rank <= 10
| fields - rank maxpctCPU
| timechart span=1h max(pctCPU) as maxpctCPU by COMMAND

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting V2

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...