I m trying to find out the search query to use in order to graph on a timeline the memory usage of a particular process or group of processes.
For example, I would like to graph splunkd memory usage over time on a particular set of server(s)
host="util-web*" source="ps" | multikv fields COMMAND filter splunkd | timechart ...
I don't know how to tell timechart that I want to sum one the ps memory column per host.
Thank you in advance for your help,
It sounds like you need to break apart the event into multiple events by using 'mvexpand':
http://www.splunk.com/base/Documentation/latest/SearchReference/Mvexpand