Splunk Search

Reporting on VM capacity over time


Date, VM1, VM2, VM3, VM4
5/1/2019 100, 100, n/a, 450
6/1/2019 100, 140, n/a, 450
7/1/2019 105, 200, n/a, n/a
8/1/2019 110, 200, n/a, n/a
9/1/2019 110, 200, n/a, n/a
10/1/2019 110, 200, 100, n/a
11/1/2019 110, 200, 200, n/a

I guess I can do this in different ways but from above but I'm trying to be able to specify 2 times from a time picker & then be able to report on overall capacity growth. I thought charting w/ earliest(VM) & latest(VM) but that does not work.

if VMs exist on both start/end- it works great.

The problem is that if a VM has been decommissioned (per above VM4) or if it was newly created (VM3) then earliest/latest for those 2 are not reported accurately. Above VM3 would report that it grew 100 when it really grew 200 from 5/1 to 11/1. VM4 reports no growth when it should read (-450) because it no longer exists.

Anyone else run into issues like this & have ideas on correctly reporting on this scenario?

0 Karma

Ultra Champion
| makeresults 
 | eval _raw="Date, VM1, VM2, VM3, VM4
5/1/2019, 100, 100, n/a, 450
6/1/2019, 100, 140, n/a, 450
7/1/2019, 105, 200, n/a, n/a
8/1/2019, 110, 200, n/a, n/a
9/1/2019, 110, 200, n/a, n/a
10/1/2019, 110, 200, 100, n/a
11/1/2019, 110, 200, 200, n/a"
| multikv forceheader=1
| table Date VM*
| foreach VM* 
    [eval <<FIELD>> = ltrim(<<FIELD>>," ")]
`comment("this is sample data")`
| eval Date = strptime(Date,"%m/%d/%Y")
| rename Date as _time

Hi, @clintla

How about it?

0 Karma


I think a chart works OK but it needs to be a table so we can look up groups of servers by type/Business unit & be able to calculate GB/% growth as a group.

N/A means the server doesnt exist. I thought about fillnull=0 but I still cant get it to fillnull over an entire non timechart (just a table/chart) so if the server was introduced in October that May through September gets 0s.

I guess the root question is that if you are doing a chart over a period of time, how do you populate capacity where a VM didnt exist with 0's.

If you timechart it, then individual VM's (we have thousands of VMs) becomes very messy. Needs to be a table or chart due to we might be searching 5 VMs or 100VMs & wanting a total growth

0 Karma


a better more exacting data set would look like this
Date ,Name,Capacit Used
5/1/2019, VM1,100
5/1/2019, VM2,100
5/1/2019, VM4,450
6/1/2019, VM1,100
6/1/2019, VM2,140
6/1/2019, VM4,450
7/1/2019, VM1,105
7/1/2019, VM2,200
8/1/2019, VM1,110
8/1/2019, VM2,200
9/1/2019, VM1,110
9/1/2019, VM2,200

How can you search it so that if you search for 7/1/2019 through 11/1/2019 that the result would be tabled as

VM3 200GB

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...