Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mark_chuman
mark_chuman
Path Finder
Member since:
08-20-2014
06-05-2020
Community Statistics
| Posts | 30 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 08-20-2014 |
Activity Feed
- Got Karma for How to overlay two searches on the same graph?. 06-05-2020 12:47 AM
- Got Karma for Re: Help with rex regex to extract a field value for a chart?. 06-05-2020 12:47 AM
- Got Karma for Re: No option to Export CSV results from dashboard UI app view????????. 06-05-2020 12:46 AM
- Posted Re: join question on Splunk Search. 03-01-2016 10:19 AM
- Posted join question on Splunk Search. 03-01-2016 09:34 AM
- Tagged join question on Splunk Search. 03-01-2016 09:34 AM
- Tagged join question on Splunk Search. 03-01-2016 09:34 AM
- Posted Re: No option to Export CSV results from dashboard UI app view???????? on Dashboards & Visualizations. 01-29-2016 07:07 AM
- Posted Re: How to increase truncation limit to display all results in a chart? on Splunk Search. 01-28-2016 05:54 AM
- Posted Re: Splunk DB Connect 1: How to use "timechart avg()" in a dbquery search? on Splunk Search. 01-27-2016 05:12 AM
- Posted Re: Splunk DB Connect 1: How to use "timechart avg()" in a dbquery search? on Splunk Search. 01-27-2016 05:09 AM
- Posted Splunk DB Connect 1: How to use "timechart avg()" in a dbquery search? on Splunk Search. 01-26-2016 02:04 PM
- Tagged Splunk DB Connect 1: How to use "timechart avg()" in a dbquery search? on Splunk Search. 01-26-2016 02:04 PM
- Tagged Splunk DB Connect 1: How to use "timechart avg()" in a dbquery search? on Splunk Search. 01-26-2016 02:04 PM
- Tagged Splunk DB Connect 1: How to use "timechart avg()" in a dbquery search? on Splunk Search. 01-26-2016 02:04 PM
- Tagged Splunk DB Connect 1: How to use "timechart avg()" in a dbquery search? on Splunk Search. 01-26-2016 02:04 PM
- Posted Re: Convert Seconds to Days on Splunk Search. 12-15-2014 08:11 AM
- Posted Re: Average CPU Usage on Splunk Search. 12-15-2014 06:16 AM
- Posted Re: Convert Seconds to Days on Splunk Search. 12-13-2014 03:02 PM
- Posted Re: Convert Seconds to Days on Splunk Search. 12-12-2014 05:59 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
03-01-2016
10:19 AM
I got it.
| dbquery "TQOMA" "SELECT "Time", "System", "%busy" FROM TQSTDBO.CPUVMSUM where "System" LIKE '%ntx%'" | eval _time=Time | timechart avg(%busy) by System
... View more
03-01-2016
09:34 AM
here is my search - | dbquery "TQOMA" "SELECT "System", "%busy" FROM TQSTDBO.CPUVMSUM where "System" LIKE '%ntx%'"
basically, this returns a result for each system every sampling period. So, what I have is one line that represents all the samplings. I'd like to have a line for each system, but can't figure out how to do this. I was thinking something like this, but doesn't seem to work.
join System [| dbquery "TQOMA" "SELECT "System", "%busy" FROM TQSTDBO.CPUVMSUM where "System" LIKE '%ntx%'"]
Thanks for any feedback!
... View more
01-29-2016
07:07 AM
1 Karma
what do you mean by stick the export module within the search? Just paste it in after your search after a pipe?
... View more
01-28-2016
05:54 AM
charting.data.count worked for me and charting.chart.resultTruncationLimit did not work.
... View more
01-27-2016
05:12 AM
So, this query completes successfully
| dbquery "TQOMA" "SELECT "Time" , "Virtual_Machine" , "ready" FROM TQSTDBO.CPUBYVM where "Virtual_Machine" BETWEEN 'vW7NTXMCSOMA001' AND 'vW7NTXMCSOMA025'"
This query completes with no results found
| dbquery "TQOMA" "SELECT "Time" , "Virtual_Machine" , "ready" FROM TQSTDBO.CPUBYVM where "Virtual_Machine" BETWEEN 'vW7NTXMCSOMA001' AND 'vW7NTXMCSOMA025'" | search Time>strptime("01/26/16 09:25:00","%m/%d/%y %H:%M:%S") AND Time<strptime("01/26/16 09:55:00","%m/%d/%y %H:%M:%S")
... View more
01-27-2016
05:09 AM
thanks. tried this before and it comes up with same result as original query
... View more
01-26-2016
02:04 PM
This search works fine:
"DBOMA" "SELECT "Time" , "Virtual_Machine" , "ready" FROM DBSTDBO.CPUBYVM where "Virtual_Machine" BETWEEN 'vmname001' AND 'vmname025'" | eval Time=strftime(Time,"%m/%d/%y %H:%M:%S") | search Time>"01/26/16 09:25:00" | search Time<"01/26/16 09:55:00"
But this search below fails with no results found. I've used timechart avg successfully before, so not sure if it's snagging on something because it's a dbquery.
"DBOMA" "SELECT "Time" , "Virtual_Machine" , "ready" FROM DBSTDBO.CPUBYVM where "Virtual_Machine" BETWEEN 'vmname001' AND 'vmname025'" | eval Time=strftime(Time,"%m/%d/%y %H:%M:%S") | search Time>"01/26/16 09:25:00" | search Time<"01/26/16 09:55:00" | timechart avg("ready") by Virtual_Machine
... View more
12-15-2014
08:11 AM
Tried to ensure I'm not using multiple conversions at once by using these two searches:
index=perfstats host=hostname | eval Uptime_Days = System_Up_Time | chart max(Uptime_Days) as "System Uptime" by host | eval System Uptime = tostring('System Uptime', "duration")
index=perfstats host=hostname | chart max(Uptime_Days) as "System Uptime" by host | eval System Uptime = tostring('System Uptime', "duration")
No data found on both. Just an FYI, no need to reply if you don't want. The initial reply is good.
... View more
12-15-2014
06:16 AM
It is grabbing the stats every 5 minutes, but it's weird as there are two stats for every 5 minute pull. They are a second apart and these are the metrics that appear to be making the trend spiky as the second metric is always much lower than the first. For example, a metric comes in at say 9:01:25 for 45% (or 45.87326) and then a metric comes in at 9:01:26 for say 2% (or 2.34344) and then the cycle starts again at 9:06:25.
... View more
12-13-2014
03:02 PM
you mean like this?
index=perfstats host=hostname | eval Uptime_Days = System_Up_Time/86400 | chart max(Uptime_Days) as "System Uptime" by host | eval System Uptime = tostring('System Uptime', "duration")
I get data like this
00:00:17.723748506149999
Thanks
... View more
12-12-2014
05:01 PM
This search:
index=perfstats host=hostname | chart max(System_Up_Time) as "System Uptime" by host
Outputs a value such as this:
85486.676230500001
Just trying to convert this value in seconds to days.
Thanks. Looked at different posts, but can't seem to convert it effectively.
... View more
12-12-2014
01:41 PM
What field are you using to get the total drive space? I hit that same problem, but was initially using %_Free_Space and it would return free space percentage across all drives.
... View more
12-12-2014
01:31 PM
Try this for drive C, for example.
index=perfstats host=servername C | timechart avg("%_Free_Space") by host
or for drive D
index=perfstats host=servername D | timechart avg("%_Free_Space") by host
... View more
12-12-2014
12:31 PM
This worked for me!
index=perfstats sourcetype=PerfmonMk* host=servername C | timechart avg("%_Free_Space") by host
... View more
12-11-2014
09:59 AM
Almost there I think.
So, I adjusted the visualization (format, connect the dots basically), but it's weird as there is what looks to be a true CPU metric followed by a very low, inaccurate metric which makes the trend line extremely spiky and doesn't really resemble what the CPU is doing.
So, the search is pretty simple - index=perfstats host=eivc201vwin | chart avg("%_Processor_Time") over _time by host
This image shows how spiky the trend line is - http://pasteboard.co/2mtXDwFl.png
This image shows the actual sample data where you see this "piggy back" type metric - http://pbrd.co/16bamV9
You'll see a reading of say 45 followed immediately by a real low reading of 3.
Thanks again for your time!
... View more
12-11-2014
07:35 AM
but for example, this search comes back very clean in the display
index=perfstats host=servername | timechart avg("%_Idle_Time") by host
... View more
12-11-2014
07:33 AM
many thanks for this and it's a big help. I'm able to use this search to effectively track the average CPU consumption for the servers, but when I say trend it out over time (7+ days for example), it doesn't look very clean as in the trend lines are actually lines, they appear more as bars.
search - index=perfstats host=servername | chart avg("%_Processor_Time") over _time by host
I'll post an image..
... View more
12-11-2014
06:21 AM
Trying to create a useful CPU usage search, but coming up short. This search does not reflect what is actually being used for some reason:
index=perfstats host=servername | timechart avg("%_Privileged_Time") by host
For example, when I compare to what the server is actually using to what the search is reporting, the search is coming back extremely low and doesn't match up with actual usage.
... View more
11-21-2014
01:50 PM
Aside from speeding things up is there a better way to chart the duration between say these two examples (between a BEGIN and FINISH log entry)?
... View more
11-21-2014
01:48 PM
yes, the transaction command is the culprit on the slow down. I'll take a look at summary indexing
... View more
11-21-2014
01:06 PM
Here is my search. I'm trying to get a report on the duration between an ESXi host sync task in vCenter logs. The search works ok in searches that are looking over say 15 minutes or so, but seriously slows down when going to 4 days and beyond. Any idea how to speed things up? Thanks!
index=distributed sourcetype=vcenter_* "task-internal" | rex "task-internal-(?\w+)" | transaction TASKID maxspan=-1 | timechart avg(duration)
Here are example log entries -
11/21/14
3:59:43.000 PM
2014-11-21T15:59:43.760-05:00 [01928 info 'commonvpxLro' opID=HB-host-52@132635-1b9acc5a] [VpxLRO] -- BEGIN task-internal-574059 -- host-52 -- VpxdInvtHostSyncHostLRO.Synchronize --
eventtype = nix-all-logs
11/21/14
3:59:43.000 PM
2014-11-21T15:59:43.758-05:00 [11912 info 'commonvpxLro' opID=HB-host-901@183888-5f049582] [VpxLRO] -- FINISH task-internal-574059 -- host-901 -- VpxdInvtHostSyncHostLRO.Synchronize --
eventtype = nix-all-logs
... View more
10-27-2014
06:10 AM
1 Karma
I have these two searches and am trying to figure out the best way to overlay them both on the same graph:
search 1
index=distributed sourcetype=vcenter_* "[Vdb::GetConnection] Failed to obtain connection" OR "SHUTDOWN is in progress." sourcetype=vcenter_vpxdlogs host=eivc2*vwin | timechart count by host
search 2
index=distributed sourcetype=vcenter_* sourcetype=vcenter_vpxdlogs "Starting VMware VirtualCenter" host=eivc2*vwin | timechart count by host
Thanks!
... View more
08-28-2014
04:24 PM
I think I got it. The samples that are returned aren't the exact same, but are the same format so the regex should work fine. Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
