Splunk Search

Sum value from distinct hosts over time

caviman2201
Path Finder

I have a bunch of hosts streaming logs that show metrics like cpu count. The problem is that they all send those logs at different times. I'm trying to calculate perform math on the aggregate metrics, but everything is wrong because I can't figure out how to perform math on the values from distinct hosts. I've searched for deduping on a span and got nowhere. Logs look something like this:

1:00:01 - ip=192.168.1.5 cpu_count=8
1:00:01 - ip=192.168.1.6 cpu_count=8
1:00:02 - ip=192.168.1.7 cpu_count=8
1:00:03 - ip=192.168.1.8 cpu_count=8
1:00:03 - ip=192.168.1.7 cpu_count=8
1:00:03 - ip=192.168.1.5 cpu_count=8
1:00:03 - ip=192.168.1.6 cpu_count=8
1:00:04 - ip=192.168.1.7 cpu_count=8
1:00:04 - ip=192.168.1.8 cpu_count=8

what i want to do is something like | dedup span=1m by ip | eval TotalPercent = cpu_count * 100 | timechart sum(TotalPercent) AS TotalAvailableCPUPercent

hope that makes sense

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You probably want bucket for grouping your events by time and deduping on that.

... | bucket _time span=1m | dedup _time ip | eval TotalPercent = cpu_count * 100 | chart sum(TotalPercent) AS TotalAvailableCPUPercent over _time

View solution in original post

0 Karma

Ayn
Legend

You probably want bucket for grouping your events by time and deduping on that.

... | bucket _time span=1m | dedup _time ip | eval TotalPercent = cpu_count * 100 | chart sum(TotalPercent) AS TotalAvailableCPUPercent over _time
0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...