Splunk Search

timechart + sort limiting number of samples?

talbot7
Path Finder

Trying to show the top 10 busiest guest VM's in mu environment.
Each guest VM is reporting its network status in the following syntax:

Apr  5 13:41:22 a4-hpc1-2 logger: xen-performance network42 : timestamp=13:41:21 pool=General1 hardware=a4-hpc1-2 guest=9895_splatqa0006_RX interface=vif8.0 bytes=0133071 MBytes=0.12

Every 20 seconds I get a status update, and how much data was transmitted in the last 20sec. When I use the following search, I can get status of most VM's.

index=performance network42 MBytes | eval MB = MBytes/20 | timechart max(MB) span=60s by guest usenull=f useother=f

The problem comes in when I try to sort the data.

index=performance network42 MBytes | eval MB = MBytes/20 | timechart max(MB) span=60s by guest usenull=f useother=f | sort num(MB) by guest limit=7

The limit on sort seems to be applying to the number of samples, not the number of guests.

Ideas?

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

First, you can simplify the timechart part by using per_second to sum the MB, and divide by 60, for example:

index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f

If you want to find the top ten spikes over a 60s period, you'd sort:

index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f | sort 10 MBpersecond

If you wanted to look for the busiest hosts, globally, you wouldn't use timechart at all:

index=performance network42 MBytes | stats sum(MBytes) as MBtotal by guest  | sort 10 MBtotal

View solution in original post

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

First, you can simplify the timechart part by using per_second to sum the MB, and divide by 60, for example:

index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f

If you want to find the top ten spikes over a 60s period, you'd sort:

index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f | sort 10 MBpersecond

If you wanted to look for the busiest hosts, globally, you wouldn't use timechart at all:

index=performance network42 MBytes | stats sum(MBytes) as MBtotal by guest  | sort 10 MBtotal

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!