Splunk Search

Timechart cpuload different results for different time intervals

1234testtest
Path Finder

Hi - I want to display the cpu, mem statistics (avg, min, max) for a specified duration - last 4 hours, 24 hours etc.,
I am using the following search. The problem is that I'm getting different values for the same time - like for eg 6AM in the morning for both these results shows different values.
Any idea what needs correction

source=WMI:CPUTime host=* | eval CPULoad = PercentProcessorTime | timechart avg(CPULoad) min(CPULoad) max(CPULoad) minspan=10m by host | join _time [search source=WMI:memory host=* | timechart avg(AvailableMBytes) min(AvailableMBytes) max(AvailableMBytes) minspan=10m by host]

0 Karma

dart
Splunk Employee
Splunk Employee

what frequency are you collecting the data on?
Why not just do one search, like so :
source=WMI:CPUTime OR source=WMI:memory | rename PercentProcessorTime as CPULoad | timechart avg(CPULoad) min(CPULoad) max(CPULoad) avg(AvailableMBytes) min(AvailableMBytes) max(AvailableMBytes) by host
When you search over different timeranges, your time windows will be different sizes, you've just specified a minimum time span - Splunk can pick a larger time span than you've specified.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...