https://community.splunk.com/t5/Dashboards-Visualizations/How-to-graph-the-memory-usage-of-a-particular-process/m-p/104318#M5887 <P>It sounds like you need to break apart the event into multiple events by using 'mvexpand':</P> <P><A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Mvexpand">http://www.splunk.com/base/Documentation/latest/SearchReference/Mvexpand</A></P> Wed, 18 May 2011 18:48:11 GMT Simeon 2011-05-18T18:48:11Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-graph-the-memory-usage-of-a-particular-process/m-p/104317#M5886 <P>I m trying to find out the search query to use in order to graph on a timeline the memory usage of a particular process or group of processes.</P> <P>For example, I would like to graph splunkd memory usage over time on a particular set of server(s)</P> <P>host="util-web*" source="ps" | multikv fields COMMAND filter splunkd | timechart ...</P> <P>I don't know how to tell timechart that I want to sum one the ps memory column per host.</P> <P>Thank you in advance for your help,</P> Wed, 18 May 2011 18:36:09 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-graph-the-memory-usage-of-a-particular-process/m-p/104317#M5886 egrignon 2011-05-18T18:36:09Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-graph-the-memory-usage-of-a-particular-process/m-p/104318#M5887 <P>It sounds like you need to break apart the event into multiple events by using 'mvexpand':</P> <P><A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Mvexpand">http://www.splunk.com/base/Documentation/latest/SearchReference/Mvexpand</A></P> Wed, 18 May 2011 18:48:11 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-graph-the-memory-usage-of-a-particular-process/m-p/104318#M5887 Simeon 2011-05-18T18:48:11Z