help on basic eval

jip31 — Tue, 18 Feb 2020 12:11:01 GMT

why "MemoryUsage" doenst return any results?

 eval FreeMemory = round(Value, 0). " MB" 
| eval TotalMemory = round((TotalPhysicalMemory / 1024 / 1024), 0). " MB" 
| eval MemoryUsage = (TotalMemory - FreeMemory) / TotalMemory
| stats last(FreeMemory) as "Free Memory", last(TotalMemory) as "Total memory", values(MemoryUsage) as "Memory Usage" by host

Is anybody can help me??

Re: help on basic eval

nickhills — Tue, 18 Feb 2020 12:25:17 GMT

Because you have added MB to FreeMemory and TotalMemory in your early evals they are no longer numeric, so you cant do maths on them any more.

remove the ."MB" from the earlier evals, and add it to them at the end:

| eval Free Memory='Free Memory'."MB", Total memory='Total memory'."MB", Memory Usage='Memory Usage'."MB"

thus:

| eval FreeMemory = round(Value, 0)
 | eval TotalMemory = round((TotalPhysicalMemory / 1024 / 1024), 0)
 | eval MemoryUsage = (TotalMemory - FreeMemory) / TotalMemory
 | stats last(FreeMemory) as "Free Memory", last(TotalMemory) as "Total memory", values(MemoryUsage) as "Memory Usage" by host
 | eval Free Memory='Free Memory'."MB", Total memory='Total memory'."MB", Memory Usage='Memory Usage'."MB"

topic help on basic eval in Splunk Search

help on basic eval

Re: help on basic eval