topic Re: How to edit my search to create a memory utilization dashboard for Windows machines? in Splunk Search

How to edit my search to create a memory utilization dashboard for Windows machines?

vn86893 — Sun, 09 Sep 2018 23:25:43 GMT

I am trying to set up a Memory utilization dashboard for Windows machines. I did try to set up the dashboard but I am able to get it only to a stage where I can set up dashboard for memory available. But I need metrics for memory utilized by time.

Here is what I am trying

index=**** sourcetype="Perfmon:Available Memory"  | bucket _time span=15m | eval gigabytes=(((Value/1024)/1024)/1024) | eval GB=round(gigabytes, 2) | timechart avg(GB) by host limit=0

Any help is greatly appreciated.

Re: How to edit my search to create a memory utilization dashboard for Windows machines?

adonio — Wed, 12 Sep 2018 00:14:19 GMT

are you collecting the perfmon metrics for memory utilization?
your search overall is on the right track ...
you can consolidate the evals
... | eval GB = round(Value/1024/1024/1024, 2)
also, pay attention to the counter field in the perfmon data

Re: How to edit my search to create a memory utilization dashboard for Windows machines?

DalJeanis — Wed, 12 Sep 2018 03:25:11 GMT

1) There is no point to bin _time before timechart. Timechart will bin for you automatically.

2) On my system, the sourcetype is "Perfmon:Memory" and the counter (for example) is "Available MBytes". review your data to be sure of the sourcetype and counter name.

3) When you divide before averaging, your rounding errors will accumulate. Better to average, then divide. In this case, I've used the MBytes, so there is only one level of division.

 index=perfmon sourcetype="Perfmon:Available Memory"  counter= "Available MBytes"
| timechart span=15m avg(Value) by host limit=0
| foreach * [ eval <<FIELD>>=round( (<<FIELD>>/1024/1024/1024),2)]