topic Re: Using a parameter that records memory usage, how do I get my transaction search to show the maximum memory usage by user? in Splunk Search

Using a parameter that records memory usage, how do I get my transaction search to show the maximum memory usage by user?

DanielFordWA — Wed, 02 Sep 2015 08:31:30 GMT

Hi,

I have a parameter system_mem that records the memory usage of an application.

I am trying to do analysis by using transactions and see each session, for the previous 100 events or so, leading up to the max memory usage.

Is it possible to have something like the search below? Currently, my transactions do not end with the maximum system_mem experienced by the user. Why is this?

index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") |  transaction GUID maxpause=60min endswith=(eventstats=max(system_mem)) mvlist=t keepevicted=true | table GUID c_time cs_uri_stem system_mem

To note I do not have a sessionId, only a unique user ID.

Thanks,

Dan

Re: Using a parameter that records memory usage, how do I get my transaction search to show the maximum memory usage by user?

woodcock — Wed, 02 Sep 2015 14:07:54 GMT

If I understand you correctly and we are assuming that a "session" can be inferred by an increase of memory usage (e.g. so long as memory is increasing, it is the same session; whenever it decreases, a new session has begun), then we can manufacture a sessionID using streamstats like this:

index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") | reverse | streamstats current=f last(system_mem) AS prev_system_mem BY GUID | eval new_session=if((system_mem<prev_system_mem),"TRUE",null()) | streamstats current=t count(new_session) AS sessionID BY GUID

Now each GUID's event has a sessionID field that can be used to distinguish/group events that can be exploited by tacking on something like | stats blah blah blah BY GUID sessionID.

Any time that you can avoid transaction, you should; it is very slow/costly to use it.

Re: Using a parameter that records memory usage, how do I get my transaction search to show the maximum memory usage by user?

thirumalreddyb — Tue, 29 Sep 2020 07:13:05 GMT

Please try this.

Hope it helps you.