How to view used memory in percentage?

[Germaine1989]

I try to view used memory in percentage.

it doesn't matter of it is in bytes or mb or gb. As long as i can see the percentage it's ok.

For now i have this:

index=main collection="Available Memory" host="******" Available bytes instance="0" counter="Available bytes" | stats latest(Value) |

[gcusello]

Hi @Germaine1989,

if you're using the Splunk TA-Windows Add-On (https://splunkbase.splunk.com/app/742/) you can enable some inputs that gives you FreePhysicalMemoryGB and TotalPhysicalMemoryGB that you can use to calculate your free memory percentage.

As sample see this search I use to display memory of a system.

index=windows sourcetype=WinHostMon Type=OperatingSystem host=$host$
| eval host=upper(host)
| dedup host 
| sort host 
| eval 
   FreePhysicalMemoryGB=FreePhysicalMemoryKB/1024/1024,
   FreeVirtualMemoryGB=FreeVirtualMemoryKB/1024/1024,
   TotalPhysicalMemoryGB=TotalPhysicalMemoryKB/1024/1024, 
   TotalVirtualMemoryGB=TotalVirtualMemoryKB/1024/1024,
   Virtual_mem_free_percent=FreeVirtualMemoryKB/TotalVirtualMemoryKB*100
| table FreePhysicalMemoryGB TotalPhysicalMemoryGB mem_free_percent FreeVirtualMemoryGB TotalVirtualMemoryGB Virtual_mem_free_percent  
| rename FreePhysicalMemoryGB AS "Free Physical Memory" TotalPhysicalMemoryGB AS "Total Physical Memory" mem_free_percent AS "Free Physical Memory%" FreeVirtualMemoryGB AS "Free Virtual Memory" TotalVirtualMemoryGB AS "Total Virtual Memory" Virtual_mem_free_percent AS "Free Virtual Memory%"

Ciao.

Giuseppe

[Germaine1989]

Thanks Giuseppe,

It doesn't work.
Can we also create a simple string which shows me the number of used memory?

[gcusello]

Hi @Germaine1989,

how do you ingest your logs? are you using the Splunk_TA-Windows or what else?

Using this TA you have all the fields already extracted and ready to use, otherwise, you have to extract and format each field.

Anyway, yes you can we also create a simple string which shows the number of used memory but this is possible after understanding of your data, for this reason I hint to use that TA becasue all fields are already extracted.

Ciao.

Giuseppe