Splunk Search

multikv and timechart | changing the default label of line in multiline chart with another dynamic value

anuragkapur
Explorer

I am trying to plot the CPU utilisation of all processes on a Solaris server using the following search query:
index="os" host="myhost" source="ps" | multikv fields PID pctCPU COMMAND forceheader=1 | timechart avg(pctCPU) by PID

This works, but I would like the lines in my chart to be labelled with the COMMAND field rather than PID. I can't change the "by" clause to COMMAND as more than one process has the same value for the COMMAND field.

Could someone please suggest a way of achieving this?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could append the command to the pid and use that as your grouping field.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could append the command to the pid and use that as your grouping field.

anuragkapur
Explorer

As suggested, this worked and gave me the result I wanted: index="os" host="myhost" source="ps" | multikv | eval pidAndCommand=PID." ".COMMAND | timechart avg(pctCPU) by pidAndCommand

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...