Is there a good way to chart the value of a field by the value of another field?
That is... I'm using the Splunk for *nix app, performing a search on that data. Setting my source="cpu". Want to extract out pctIdle by CPU core. I can do it pretty easily for each individual core with something like this:
index=os source="cpu" host="host1" | multikv fields cpu | search CPU="1" |table pctIdle
but what I really want to do is have a multi column table with that value in real-time by cpu core (and eventually, a visualization by column).
Thank you for your help!
... View more