I have the following that should display the current free memory in a windows system. However, it appears that I am missing something.
index="perfmonmemory" | eval mem_free=mem_free/1024 | eval mem_free=round(mem_free,0) | timechart count span=1min | bin _time span=1min | stats avg(mem_free) as rpm | gauge rpm 10 20 30 40 50 60
A bunch of things wrong with that search.
You are not looking for a time series, so no point in timechart.
Your timechart is just calculating count, so when you try to use mem_free after the timechart, that field is no longer present.
You are using 'bin' command, which is about splicing by time, but you're not actually using _time in your stats - if you want to bin by _time with stats, then you do stats ... by _time after the bin.
This should get you to what you want
index="perfmonmemory"
| eval mem_free=mem_free/1024
| eval mem_free=round(mem_free,0)
| stats avg(mem_free) as rpm
| gauge rpm 10 20 30 40 50 60
A bunch of things wrong with that search.
You are not looking for a time series, so no point in timechart.
Your timechart is just calculating count, so when you try to use mem_free after the timechart, that field is no longer present.
You are using 'bin' command, which is about splicing by time, but you're not actually using _time in your stats - if you want to bin by _time with stats, then you do stats ... by _time after the bin.
This should get you to what you want
index="perfmonmemory"
| eval mem_free=mem_free/1024
| eval mem_free=round(mem_free,0)
| stats avg(mem_free) as rpm
| gauge rpm 10 20 30 40 50 60