![]() ![]() You may need to play with a bit to get the intended results. Host="CARDS_QA_*" (sourcetype=cpu OR source=WMI:CPUTime) |eval PercentProcessorTime=(100-mvindex(pctIdle,0))|fields _time host, PercentProcessorTime| timechart span=5m avg(PercentProcessorTime) as Percent_CPU_Load by host If everthing looks good I then peform a timechart command. |fields _time host, PercentProcessorTime ![]() Fields command is a great way to table and verify your data. I should see values for both *Nix and Win systems now in the PercentProcessorTime. Then I uses the field command to verify the values by host. |eval PercentProcessorTime=(100-mvindex(pctIdle,0)) I use mvindex to return the first value 0 in the multivalued field called pctIdle. This section tries to turn pctIdle into a percent and adds it to the field PercentProcessorTime just like the pre-existing field in Win data. Host="CARDS_QA_*" (sourcetype=cpu OR source=WMI:CPUTime) I assuem that this base search returns your events for both systems. Since it looks like you have multivalued fields for you *Nix event I would uses mvindex to return single or subset. My first step would be to normallize the data. I am also assuming that you only want pctIdle where pctUser equals all. Ok, If I understand your objective correctly you would like to display CPU usage as percentage regardless of if the system is Win or *Nix. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |