Splunk Search

Reporting on VM capacity over time

clintla
Contributor

Date, VM1, VM2, VM3, VM4
5/1/2019 100, 100, n/a, 450
6/1/2019 100, 140, n/a, 450
7/1/2019 105, 200, n/a, n/a
8/1/2019 110, 200, n/a, n/a
9/1/2019 110, 200, n/a, n/a
10/1/2019 110, 200, 100, n/a
11/1/2019 110, 200, 200, n/a

I guess I can do this in different ways but from above but I'm trying to be able to specify 2 times from a time picker & then be able to report on overall capacity growth. I thought charting w/ earliest(VM) & latest(VM) but that does not work.

if VMs exist on both start/end- it works great.

The problem is that if a VM has been decommissioned (per above VM4) or if it was newly created (VM3) then earliest/latest for those 2 are not reported accurately. Above VM3 would report that it grew 100 when it really grew 200 from 5/1 to 11/1. VM4 reports no growth when it should read (-450) because it no longer exists.

Anyone else run into issues like this & have ideas on correctly reporting on this scenario?

0 Karma

to4kawa
Ultra Champion
| makeresults 
 | eval _raw="Date, VM1, VM2, VM3, VM4
5/1/2019, 100, 100, n/a, 450
6/1/2019, 100, 140, n/a, 450
7/1/2019, 105, 200, n/a, n/a
8/1/2019, 110, 200, n/a, n/a
9/1/2019, 110, 200, n/a, n/a
10/1/2019, 110, 200, 100, n/a
11/1/2019, 110, 200, 200, n/a"
| multikv forceheader=1
| table Date VM*
| foreach VM* 
    [eval <<FIELD>> = ltrim(<<FIELD>>," ")]
`comment("this is sample data")`
| eval Date = strptime(Date,"%m/%d/%Y")
| rename Date as _time

Hi, @clintla
Visualisation

How about it?

0 Karma

clintla
Contributor

I think a chart works OK but it needs to be a table so we can look up groups of servers by type/Business unit & be able to calculate GB/% growth as a group.

N/A means the server doesnt exist. I thought about fillnull=0 but I still cant get it to fillnull over an entire non timechart (just a table/chart) so if the server was introduced in October that May through September gets 0s.

I guess the root question is that if you are doing a chart over a period of time, how do you populate capacity where a VM didnt exist with 0's.

If you timechart it, then individual VM's (we have thousands of VMs) becomes very messy. Needs to be a table or chart due to we might be searching 5 VMs or 100VMs & wanting a total growth

0 Karma

clintla
Contributor

a better more exacting data set would look like this
Date ,Name,Capacit Used
5/1/2019, VM1,100
5/1/2019, VM2,100
5/1/2019, VM4,450
6/1/2019, VM1,100
6/1/2019, VM2,140
6/1/2019, VM4,450
7/1/2019, VM1,105
7/1/2019, VM2,200
8/1/2019, VM1,110
8/1/2019, VM2,200
9/1/2019, VM1,110
9/1/2019, VM2,200
10/1/2019,VM1,110
10/1/2019,VM2,200
10/1/2019,VM3,100
11/1/2019,VM1,110
11/1/2019,VM2,200
11/1/2019,VM3,200

How can you search it so that if you search for 7/1/2019 through 11/1/2019 that the result would be tabled as

VM1 5GB
VM2 0GB
VM3 200GB

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...