Splunk Search

Questions on Variable Manipulation.

Communicator

I've got a chart that works great but just wanting to re-arrange the result.

timechart eval(sum(Logical_Capacity_Blocks)/ 2047752704) as Configured_Capacity, eval(sum(Free_Capacity_Blocks_non_contiguous)/ 2047752704) as Free_Space,

So this gives me 2 working variables
Configured_Capacity
Free_Space

Seems reasonable to be able to subtract the 2 at the end of the search.

Wanting to end with a Graph where I can stack Used & Free Space
to show my capacity but many variations per below just dont work.

timechart eval(sum(Logical_Capacity_Blocks)/ 2047752704) as Configured_Capacity, eval(sum(Free_Capacity_Blocks_non_contiguous)/ 2047752704) as Free_Space, eval(Configured_Capacity - Free_Space)

Seems like it should be an easy process but so far- its been tougher than expected.
Hoping I can get someone to show me some other ways to do this.

Thanks,
Clint

Tags (3)
0 Karma
1 Solution

Path Finder

The following results in 3 values being charted over time.
| timechart eval(sum(pctCPU)*5) as sumcpu, eval(sum(pctMEM)*5) as summem | eval mydiff=(sumcpu+summem)/10
The calculations are not meaningful. Just an example for form.
I ran this search in the Splunk Search App - Advanced Charting View.
My chart shows sumcpu, summem and mydiff charted over time without adding anything after the last eval command.

View solution in original post

0 Karma

Path Finder

The following results in 3 values being charted over time.
| timechart eval(sum(pctCPU)*5) as sumcpu, eval(sum(pctMEM)*5) as summem | eval mydiff=(sumcpu+summem)/10
The calculations are not meaningful. Just an example for form.
I ran this search in the Splunk Search App - Advanced Charting View.
My chart shows sumcpu, summem and mydiff charted over time without adding anything after the last eval command.

View solution in original post

0 Karma

Path Finder

| stats sum(Logical_CapacityBlocks) as sumconf, sum(Free_CapacityBlocks) as sumfree by _time| eval Configured_Capacity=sumconf/2047752704 | eval Free_Space=sumfree/2047752704 | eval Used_Space=Configured_Capacity-Free_Space | chart values(Used_Space) as Used_Space, values(Free_Space) as Free_Space over _time

0 Karma

Communicator

Thanks, One of the Auto-Fields changed. I changed it back & now I get all 3 lists correctly.

So I guess what is left is now that I have my 3 columns. I only wanted capacity for calculations. How do I tell it only graph used & free?

0 Karma

Path Finder

Are you running the timechart search in the Advanced Charting View?

If you add "| table Used_Space Configured_Capacity Free_Space" to the end of the search and run in the regular search tab, do you see results?

0 Karma

Communicator

With the "timechart eval(sum(Logical_CapacityBlocks_)/ 2047752704) as Configured_Capacity, eval(sum(Free_CapacityBlocks_non_contiguous_)/ 2047752704) as Free_Space | eval Used_Space=(Configured_Capacity - Free_Space)" search-

It does not add a column for Used_Space, nor does it
list any values. (although it does not give an error &
does find all the values with the green checked matching events) Not sure why your sample w/ CPU does, not sure whats different.

0 Karma

Path Finder

Using your timechart syntax above in the Advanced Charting View,
timechart eval(sum(Logical_CapacityBlocks_)/ 2047752704) as Configured_Capacity, eval(sum(Free_CapacityBlocks_non_contiguous_)/ 2047752704) as Free_Space
| eval Used_Space=(Configured_Capacity - Free_Space)

should chart all 3 values (Configured_Capacity, Free_Space, Used_Space)

0 Karma

Communicator

Thanks for the reply,

So I dont get an error with the changes per above.
Should something like below added to the end work?

| timechart values(Used_Space),values(Free_Space)

(only have 1 entry & that doesnt show any info).
Is there a better way to chart it?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!