https://community.splunk.com/t5/Splunk-Search/free-vs-used-visualization-ideas/m-p/17601#M2467 <P>I typically use a stacked area or column chart to represent free vs. used quantities. This is because together the free+used should equal the total in the system. Of course, in some metrics, the OS itself will take a slice that's either unreported or reported as buffers/cached. If you want to preserve the relative usage regardless of system usage, you can switch from an ordinary stacked chart to a 100% stacked chart.</P> <P>Assuming that you have two fields in your time-series data, one for free and one for used, you can just use timechart: <CODE>... | timechart median(free) median(used)</CODE>. If you want to look at extremal behavior, use <CODE>min(free)</CODE> and <CODE>max(used)</CODE>.</P> Wed, 18 Aug 2010 00:29:02 GMT Stephen_Sorkin 2010-08-18T00:29:02Z https://community.splunk.com/t5/Splunk-Search/free-vs-used-visualization-ideas/m-p/17600#M2466 <P>I'd like to chart free memory vs. used memory over time on the same Splunk dashboard module. I'm trying to figure out a good visualization to use.</P> <P>This sounds like a pretty common charting use-case. Splunk experts: how have you visualized free vs. used metrics in your own reports, and what Splunk commands did you use to create that visualization?</P> Sat, 17 Jul 2010 10:51:35 GMT https://community.splunk.com/t5/Splunk-Search/free-vs-used-visualization-ideas/m-p/17600#M2466 Justin_Grant 2010-07-17T10:51:35Z https://community.splunk.com/t5/Splunk-Search/free-vs-used-visualization-ideas/m-p/17601#M2467 <P>I typically use a stacked area or column chart to represent free vs. used quantities. This is because together the free+used should equal the total in the system. Of course, in some metrics, the OS itself will take a slice that's either unreported or reported as buffers/cached. If you want to preserve the relative usage regardless of system usage, you can switch from an ordinary stacked chart to a 100% stacked chart.</P> <P>Assuming that you have two fields in your time-series data, one for free and one for used, you can just use timechart: <CODE>... | timechart median(free) median(used)</CODE>. If you want to look at extremal behavior, use <CODE>min(free)</CODE> and <CODE>max(used)</CODE>.</P> Wed, 18 Aug 2010 00:29:02 GMT https://community.splunk.com/t5/Splunk-Search/free-vs-used-visualization-ideas/m-p/17601#M2467 Stephen_Sorkin 2010-08-18T00:29:02Z