Dashboards & Visualizations

Gauge Not Showing Correct Number?

pmacdonald
Explorer

I have the following that should display the current free memory in a windows system. However, it appears that I am missing something.

 

index="perfmonmemory" | eval mem_free=mem_free/1024 | eval mem_free=round(mem_free,0) | timechart count span=1min | bin _time span=1min | stats avg(mem_free) as rpm | gauge rpm 10 20 30 40 50 60
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

A bunch of things wrong with that search.

You are not looking for a time series, so no point in timechart.

Your timechart is just calculating count, so when you try to use mem_free after the timechart, that field is no longer present.

You are using 'bin' command, which is about splicing by time, but you're not actually using _time in your stats - if you want to bin by _time with stats, then you do stats ... by _time after the bin.

This should get you to what you want

index="perfmonmemory" 
| eval mem_free=mem_free/1024 
| eval mem_free=round(mem_free,0) 
| stats avg(mem_free) as rpm 
| gauge rpm 10 20 30 40 50 60

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

A bunch of things wrong with that search.

You are not looking for a time series, so no point in timechart.

Your timechart is just calculating count, so when you try to use mem_free after the timechart, that field is no longer present.

You are using 'bin' command, which is about splicing by time, but you're not actually using _time in your stats - if you want to bin by _time with stats, then you do stats ... by _time after the bin.

This should get you to what you want

index="perfmonmemory" 
| eval mem_free=mem_free/1024 
| eval mem_free=round(mem_free,0) 
| stats avg(mem_free) as rpm 
| gauge rpm 10 20 30 40 50 60

 

Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...