CPU utilization calendar for Dell Isilon NAS
When you’re looking for a time to run a job, you generally want to run it when there’s sufficient capacity to handle it. You want to create a busy/free calendar showing CPU utilization throughout the day and week.
Data required
Procedure
Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype="emc:isilon:*" stats.key="node.cpu.*" Cluster_Name="<name of cluster>"
| eval {stats.key}='stats.value'
| bin _time span=1h
| stats max(node.cpu.*) AS node.cpu.* BY _time
| timechart span=1h latest(eval('node.cpu.count' * 100)) AS maxCPU, p99(node.cpu.sys.max) AS sysCPU, p99(node.cpu.user.max) AS userCPU
| eval utilCPU=sysCPU+userCPU, "% Available CPU"=maxCPU-utilCPU
| fields _time, "% Available CPU"
Search explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
| Splunk Search | Explanation |
|---|---|
|
sourcetype="emc:isilon:*" |
Search only EMC Isilon data. |
|
stats.key="node.cpu.*" |
Search for events containing node.cpu.* attributes, which indicate node CPU usage. |
|
Cluster_Name="<name of cluster>" |
Enter the cluster name here to limit the search to a specific cluster. You can also omit this filter entirely and get the metric for all the clusters. |
|
| eval {stats.key}='stats.value' |
Assign the stats value to each unique stats.key. In this example we have two eval fields, one for system and one for user cpu. |
|
| bin _time span=1h |
Group the results into one hour buckets. |
|
| stats max(node.cpu.*) AS node.cpu.* BY _time |
Calculate the maximum available CPU for each hour. |
|
| timechart span=1h latest(eval('node.cpu.count' * 100)) AS maxCPU, p99(node.cpu.sys.max) AS sysCPU, p99(node.cpu.user.max) AS userCPU |
Graph the results in one hour increments. This timechart command includes a calendar heat map query. For more information on creating heat map queries, see Calendar Heat Map. |
|
| eval utilCPU=sysCPU+userCPU, "% Available CPU"=maxCPU-utilCPU |
Calculate the percentage of available CPU. |
|
| fields _time, "% Available CPU" |
Show only the fields listed. |
Next steps
The results are shown as a heat map with a row for each metric value and the color indicating the magnitude of the value. Green means more CPU is available, and the scale gradually moves toward red to indicate less available CPU. When you’re planning to run a job, you can consult this calendar to find quiet (green) time over the course of the past week, indicating it’s probably a good time to schedule the job.
Finally, you might be interested in other processes associated with the Managing Dell Isilon network attached storage use case.