Skip to main content
Splunk Lantern

CPU utilization calendar for Dell Isilon NAS

You might need to see when the CPU of your Dell Isilon network attached storage (NAS) is busiest and most free when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

When you’re looking for a time to run a job, you generally want to run it when there’s sufficient capacity to handle it. You want to create a busy/free calendar showing CPU utilization throughout the day and week. 

To optimize the search shown below, you should specify an index and a time range. 

  1. Run the following search: 
sourcetype="emc:isilon:*" stats.key="node.cpu.*" Cluster_Name="<name of cluster>"
| eval {stats.key}='stats.value'
| bin _time span=1h
| stats max(node.cpu.*) AS node.cpu.* BY _time
| timechart span=1h latest(eval('node.cpu.count' * 100)) AS maxCPU, p99(node.cpu.sys.max) AS sysCPU, p99(node.cpu.user.max) AS userCPU
| eval utilCPU=sysCPU+userCPU, "% Available CPU"=maxCPU-utilCPU
| fields _time, "% Available CPU"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype="emc:isilon:*" 

Search only EMC Isilon data.

stats.key="node.cpu.*" 

Search for events containing node.cpu.* attributes, which indicate node CPU usage. 

Cluster_Name="<name of cluster>"

Enter the cluster name here to limit the search to a specific cluster. You can also omit this filter entirely and get the metric for all the clusters. 

| eval {stats.key}='stats.value'

Assign the stats value to each unique stats.key. In this example we have two eval fields, one for system and one for user cpu.

| bin _time span=1h

Group the results into one hour buckets. 

| stats max(node.cpu.*) AS node.cpu.* BY _time

Calculate the maximum available CPU for each hour. 

| timechart span=1h latest(eval('node.cpu.count' * 100)) AS maxCPU, p99(node.cpu.sys.max) AS sysCPU, p99(node.cpu.user.max) AS userCPU

Graph the results in one hour increments.

This timechart command includes a calendar heat map query. For more information on creating heat map queries, see Calendar Heat Map.

| eval utilCPU=sysCPU+userCPU, "% Available CPU"=maxCPU-utilCPU

Calculate the percentage of available CPU.

| fields _time, "% Available CPU"

Show only the fields listed.

Result

The results are shown as a heat map with a row for each metric value and the color indicating the magnitude of the value. Green means more CPU is available, and the scale gradually moves toward red to indicate less available CPU. When you’re planning to run a job, you can consult this calendar to find quiet (green) time over the course of the past week, indicating it’s probably a good time to schedule the job.

  • Was this article helpful?