Splunk Search

Need help on timechart with value

jackin
Path Finder

Hi,

Here's my query -

| mstats max(_value) avg(_value) min(_value) prestats=true WHERE metric_name="cpu.system" AND"index"="osnixperf" AND 
[| inputlookup Unix.csv] BY host span=1h
| stats Avg(_value) AS Avg1 BY host
| join
[| mstats max(_value) avg(_value) min(_value) prestats=true WHERE metric_name="cpu.user" AND"index"="osnixperf" AND
[| inputlookup Unix.csv] BY host span=1h
| stats Avg(_value) AS Avg2 BY host]
| eval totalavg=Avg1+Avg2,totalavg=round(totalavg,2)

I need the timechart that shows with totalavg value like below image. 

jackin_0-1635926340469.png

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your stats commands are removing the time element from your results - try something like this

| mstats max(_value) avg(_value) AS Avg1 min(_value) prestats=true WHERE metric_name="cpu.system" AND"index"="osnixperf" AND 
[| inputlookup Unix.csv] BY host span=1h 
| join 
[| mstats max(_value) avg(_value) AS Avg2 min(_value) prestats=true WHERE metric_name="cpu.user" AND"index"="osnixperf" AND 
[| inputlookup Unix.csv] BY host span=1h 
| eval totalavg=Avg1+Avg2,totalavg=round(totalavg,2)
0 Karma

jackin
Path Finder

@ITWhisperer Hi,

Its looks as working but but it not showing any values and error msg's
can you give me any suggestions to my query OR can you help any different way to calculate the  2 metrics.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK start with the first mstats - does this give you what you expect from just that index?

Then try the second mstats separately - does this give you what you expect from just that index?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...