topic Re: Memory usage 100% stacked graphs for multiple servers? in Splunk Search

Memory usage 100% stacked graphs for multiple servers?

dang — Wed, 22 Aug 2012 20:36:58 GMT

Based on Stephen Sorkin's advice here, I'm attempting to create some 100% stacked graphs for memory usage across a number of servers.

Here's what I have working for a single server:

index=data ComputerName=Server01 source=WMI:Server_Memory | eval FreeGB=AvailableBytes/1024/1024/1024 | eval UsedGB=CommittedBytes/1024/1024/1024 | timechart span=5min median(FreeGB) median(UsedGB)

The problem I'm having is splitting this out by ComputerName. Any recommendations are appreciated

Re: Memory usage 100% stacked graphs for multiple servers?

jonuwz — Wed, 22 Aug 2012 22:27:44 GMT

Should be as simple as this :

index=data ComputerName=* source=WMI:Server_Memory | eval FreeGB=AvailableBytes/1024/1024/1024 | eval UsedGB=CommittedBytes/1024/1024/1024 | timechart span=5min median(FreeGB) median(UsedGB) by ComputerName

Depending on the number of servers, you might need to experiment with limit=X as an option to the timechart

John

Re: Memory usage 100% stacked graphs for multiple servers?

dang — Wed, 22 Aug 2012 22:40:47 GMT

Actually, it's very close to being that simple. I figured it out once I was able to stop multitasking with other things. The trick is to not use "timechart" but to use "chart" like this:

 index=data ComputerName=Server* source=WMI:Server_Memory | eval FreeGB=AvailableBytes/1024/1024/1024 | eval UsedGB=CommittedBytes/1024/1024/1024 | chart median(FreeGB) median(UsedGB) by ComputerName

Limiting the result set is definitely something we'll need to do, but that's got us well on the way. Thanks John.

Re: Memory usage 100% stacked graphs for multiple servers?

jonuwz — Wed, 22 Aug 2012 23:55:57 GMT

Thats tough.

You can have 2 stacked charts per time interval, if you use flashcharts, duplicate the Yaxis, and set the spacing to 0 and 0.5.

Anything more than 2 Y axis and the bars overlap (you can't control the width of the bars, only the spacing between them)

I'm guessing you have more than 2 servers though ...

This :

Just gives you a jumble of lines.

I'd go with a summary chart showing free memory % per server over time.

Then have a separate chart, with a dropdown list of servers, that shows the stacked free and used memory over time for the selected server.

Be interesting to hear some other options..

John

Re: Memory usage 100% stacked graphs for multiple servers?

jonuwz — Wed, 22 Aug 2012 23:58:40 GMT

Ah - I thought you needed a timeseries ( based on the other question you linked.

You can have 2 stacked charts per time interval, if you use flashcharts, duplicate the Yaxis, and set the spacing to 0 and 0.5.

Anything more than 2 Y-axes and the bars overlap and it looks rubbish.

I'm guessing you have more than 2 servers though ...

Re: Memory usage 100% stacked graphs for multiple servers?

gkanapathy — Thu, 23 Aug 2012 04:20:13 GMT

If you did need a timechart, you would have to use something like this: http://docs.splunk.com/Documentation/Splunk/latest/User/ReportOfMultipleDataSeries

Re: Memory usage 100% stacked graphs for multiple servers?

gkanapathy — Thu, 23 Aug 2012 04:20:36 GMT

timechart help: http://docs.splunk.com/Documentation/Splunk/latest/User/ReportOfMultipleDataSeries

Re: Memory usage 100% stacked graphs for multiple servers?

jonuwz — Mon, 28 Sep 2020 12:19:06 GMT

Odd. - the scenario listed is valid and works, though I distinctly remember this failing for me before..

index=_internal series=splunk* kbps > 0 eps > 0 | timechart span=1m avg(kbps) as throughput avg(eps) as load by series

gives the same results as this (apart from the legend)

Re: Memory usage 100% stacked graphs for multiple servers?

gkanapathy — Thu, 23 Aug 2012 13:53:55 GMT

This looks like there has been an enhancement was made in version 4.3. to have timechart automatically do what used to require the xyseries technique.

Re: Memory usage 100% stacked graphs for multiple servers?

jonuwz — Thu, 23 Aug 2012 13:56:34 GMT

Very likely. On 4.3.2 you can't specify the span if you have multiple series. Its valid on 4.3.3 though.