Disclaimer - Fairly New to Splunk
I'm stuck on building a table for a dashboard.
I would like to list a table of Computer Names with columns displaying the last 5min average values for CPU% / Mem% / DiskTransfers / etc
The search is
index=azure sourcetype="mscs:azure:eventhub:vmmetrics" body.Computer=* body.ObjectName="Processor"
| stats first(body.CounterValue) by body.Computer
That gives me the last Processor value for each Computer. (I cant do 5min average - that can be a bonus point answer !)
How would I add the same search into the table but with replacing the body.ObjectName field value for
body.ObjectName="Memory"
and then
body.ObjectName="DiskTransfers"
and then combine that into one table .
Thanks for helping 🙂
Use chart instead of stats
| chart first(CounterValue) over body.Computer by body.CounterName
Thanks for the reply - yes - that's going the right way. I appreciate that answering questions, when you cant see the data is best effort.
That does produce a table ('body.objectname' has become 'body.CounterName') as you can see.
index=azure sourcetype="mscs:azure:eventhub:vmmetrics" body.Computer=* (body.CounterName="% Processor Time" OR body.CounterName="% Committed Bytes In Use" OR body.CounterName="Disk Transfers/sec")
| eval CounterValue=round('body.CounterValue',0)
| stats first(CounterValue) by body.Computer body.CounterName
DO you know how I would get the body.CounterName fields to be the column headers?
Computername | CPU% | MEM% | DiskRate |
Comp1 | 3 | 45 | 34 |
Comp2 | 5 | 56 | 2 |
etc
Do you join up multiple searches or perhaps transpose or can you do a Stats field by field by field?
Use chart instead of stats
| chart first(CounterValue) over body.Computer by body.CounterName
Yes - chart did the trick! Thanks
Without the benefit of seeing your events data, try something like this:
index=azure sourcetype="mscs:azure:eventhub:vmmetrics" body.Computer=* (body.ObjectName="Processor" OR body.ObjectName="Memory" OR body.ObjectName="DiskTransfers")
| stats first(body.CounterValue) by body.Computer body.ObjectName