All Apps and Add-ons

How to view used memory in percentage?

Germaine1989
Engager

I try to view used memory in percentage.

it doesn't matter of it is in bytes or mb or gb. As long as i can see the percentage it's ok.

 

For now i have this:

index=main collection="Available Memory" host="******" Available bytes instance="0" counter="Available bytes" | stats latest(Value) |

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Germaine1989,

if you're using the Splunk TA-Windows Add-On (https://splunkbase.splunk.com/app/742/) you can enable some inputs that gives you FreePhysicalMemoryGB and TotalPhysicalMemoryGB that you can use to calculate your free memory percentage.

As sample see this search I use to display memory of a system.

index=windows sourcetype=WinHostMon Type=OperatingSystem host=$host$
| eval host=upper(host)
| dedup host 
| sort host 
| eval 
   FreePhysicalMemoryGB=FreePhysicalMemoryKB/1024/1024,
   FreeVirtualMemoryGB=FreeVirtualMemoryKB/1024/1024,
   TotalPhysicalMemoryGB=TotalPhysicalMemoryKB/1024/1024, 
   TotalVirtualMemoryGB=TotalVirtualMemoryKB/1024/1024,
   Virtual_mem_free_percent=FreeVirtualMemoryKB/TotalVirtualMemoryKB*100
| table FreePhysicalMemoryGB TotalPhysicalMemoryGB mem_free_percent FreeVirtualMemoryGB TotalVirtualMemoryGB Virtual_mem_free_percent  
| rename FreePhysicalMemoryGB AS "Free Physical Memory" TotalPhysicalMemoryGB AS "Total Physical Memory" mem_free_percent AS "Free Physical Memory%" FreeVirtualMemoryGB AS "Free Virtual Memory" TotalVirtualMemoryGB AS "Total Virtual Memory" Virtual_mem_free_percent AS "Free Virtual Memory%"

Ciao.

Giuseppe

Germaine1989
Engager

Thanks Giuseppe,

 

It doesn't work.
Can we also create a simple string which shows me the number of used memory?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Germaine1989,

how do you ingest your logs? are you using the Splunk_TA-Windows or what else?

Using this TA you have all the fields already extracted and ready to use, otherwise, you have to extract and format each field.

Anyway, yes you can we also create a simple string which shows the number of used memory but this is possible after understanding of your data, for this reason I hint to use that TA becasue all fields are already extracted.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...