I'm trying to write a search that will compare values from different data inputs and return the highest value to use as a rangemap. The values are cpu usage, memory usage, disk read percentage and write percentage. CPU, memory and Disk IO come from different data inputs. When I use the search below, it build the table I want, but the different inputs show up on different rows, so the compare doesn't function properly. My search is:
index="rws_wmi" ComputerName=csiadrws01 | eval cpu=PercentProcessorTime | eval mem=PercentCommittedBytesInUse | eval read=PercentDiskReadTime | eval write=PercentDiskWriteTime | eval health=max(cpu, mem, read, write) | rangemap field=health low=0-50 elevated=51-80 severe=81-100 | table cpu mem read write health range
Any advice would be great.
asked 20 Dec '11, 08:09
Try this instead
I don't really understand the health field, but I still think this will work. If it doesn't, try running the command without the eval and rangemap, just to see what you get back. Note that the spacing is just for readability.
answered 21 Dec '11, 13:59