Splunk Search

Timechart cpuload different results for different time intervals

1234testtest
Path Finder

Hi - I want to display the cpu, mem statistics (avg, min, max) for a specified duration - last 4 hours, 24 hours etc.,
I am using the following search. The problem is that I'm getting different values for the same time - like for eg 6AM in the morning for both these results shows different values.
Any idea what needs correction

source=WMI:CPUTime host=* | eval CPULoad = PercentProcessorTime | timechart avg(CPULoad) min(CPULoad) max(CPULoad) minspan=10m by host | join _time [search source=WMI:memory host=* | timechart avg(AvailableMBytes) min(AvailableMBytes) max(AvailableMBytes) minspan=10m by host]

0 Karma

dart
Splunk Employee
Splunk Employee

what frequency are you collecting the data on?
Why not just do one search, like so :
source=WMI:CPUTime OR source=WMI:memory | rename PercentProcessorTime as CPULoad | timechart avg(CPULoad) min(CPULoad) max(CPULoad) avg(AvailableMBytes) min(AvailableMBytes) max(AvailableMBytes) by host
When you search over different timeranges, your time windows will be different sizes, you've just specified a minimum time span - Splunk can pick a larger time span than you've specified.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...