Splunk Search

Why am I getting an error on this timechart syntax when trying to display two curves?

Contributor

Hello
I need help to display two curves in my chart and the 2 curves refer to host="$field1$ and host="$field2$
So I am trying to do an eval(avg(if(host="$field1$..... host="$field2$.... in timechart pipe
I also need a round number with 2 decimals of the field "PercentProcessorTime" but I always have errors.
Could you help me, please?

   index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$  host="$field2$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$ 
        | rex field=Name "^(?<Service>[^\/]+)[\/]" 

    | sort -_time 

    | rex field=Name "^(?<Service>[^\/]+)[\/]" 

    | sort -_time 
    |timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG by Service
0 Karma
1 Solution

Legend

@jip31, before we begin to look at your actual issue, some corrections
1) (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$ in your base search are mentioned twice and have no effect on filtering results. You should have only one.
2) Following is mentioned twice in your search which seems copy paste error:

 | rex field=Name "^(?<Service>[^\/]+)[\/]" 
 | sort -_time

3) By defaults events are sorted in reverse chronological order and timechart should show them up properly without sort - _time. This seems to be just an overhead to your current query. Even if you need this for some other reason like working with streamstats then reverse is a better command.

Having said these can you share your current output and also what is the expected output? When you mentioned two curves by hosts what did you mean? Can you add a mock screenshot or table output of what is required?

Can you try the following to see if it works for you?

 index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
| rex field=Name "^(?<Service>[^\/]+)[\/]" 
| eval key=Service."-".host
| timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG by key
| eval PercentProcessorTime_AVG =round(PercentProcessorTime_AVG,1)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Legend

@jip31, before we begin to look at your actual issue, some corrections
1) (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$ in your base search are mentioned twice and have no effect on filtering results. You should have only one.
2) Following is mentioned twice in your search which seems copy paste error:

 | rex field=Name "^(?<Service>[^\/]+)[\/]" 
 | sort -_time

3) By defaults events are sorted in reverse chronological order and timechart should show them up properly without sort - _time. This seems to be just an overhead to your current query. Even if you need this for some other reason like working with streamstats then reverse is a better command.

Having said these can you share your current output and also what is the expected output? When you mentioned two curves by hosts what did you mean? Can you add a mock screenshot or table output of what is required?

Can you try the following to see if it works for you?

 index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
| rex field=Name "^(?<Service>[^\/]+)[\/]" 
| eval key=Service."-".host
| timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG by key
| eval PercentProcessorTime_AVG =round(PercentProcessorTime_AVG,1)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Contributor

hi 2 curves because I have 2 hosts: host="$field1$ and host="$field2$

i wrote this :
index="windows-wmi" sourcetype="WMI:CPUload" host="$field1$" (Name="mfetp/" OR Name="mcshield/") Name=$Service$
| rex field=Name "^(?[^\/]+)[\/]" | eval key=Service."-".host | timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG, avg(PercentProcessorTime) as PercentProcessorTime_AVG by key | eval PercentProcessorTime_AVG =round(PercentProcessorTime_AVG,1)

Is it correct??
Is someone could give me another solution with eval(avg(if.... please??

0 Karma

Are you trying to display host information on graph, please elaborate, I did not get your question.

0 Karma