Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Trying to chart process over time unsuccessful...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Able to get the expected value running this query, however how would I plot this over time as a timechart?
sourcetype=Script:RunningProc eventtype=Security-proc1 | appendpipe [stats avg(CPUPct) as "CPU %" by Instance] | stats sum(CPU %)
output:
sum(CPU %)
0.156074
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
sourcetype=Script:RunningProc eventtype=Security-proc1
| timechahrt avg(CPUPct) by instance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
sourcetype=Script:RunningProc eventtype=Security-proc1
| timechahrt avg(CPUPct) by instance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the response somesoni2, however in order to produce the accurate value, the | stats sum(CPU %) needs to be included in the query. (issues with the way windows perfmon passes cpu data). looking to timechart the result sum(CPU % over a period of time and having no luck.
sourcetype=Script:RunningProc eventtype=Security-proc1 | appendpipe [stats avg(CPUPct) as "CPU %" by Instance] | stats sum(CPU %)
output:
sum(CPU %)
0.156074
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How about this? (update span value in bucket command and timechart command per your need)
sourcetype=Script:RunningProc eventtype=Security-proc1 | bucket span=15m _time | stats avg(CPUPct) as "CPU %" by _time instance | timechart span=15m sum("CPU %") as "CPU %"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This seemed to work perfectly, thank you somesoni2
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
