Dashboards & Visualizations

How to plot a bar chart to plot fields with KB,Bytes,MB and GB values?

smdasim
Explorer

Hi ,

I have split the below log into key value paris ParEdenSpace_init=6.5 MB ParEdenSpace_Used=204.6 ParEdenSpace_Commited=1.7 GB and ParEdenSpace_Max=12.8 GB.

I have used below query to plot the data, however, the minParEdenSpaceUsed value is in KB but it is showing high value in the graph attached. How would I normalize the values before I plot the data and how to identify if the value is in bytes, MB or GB and then convert into standard GB or MB.

timechart span=1d min(ParEdenSpace_Used) as minParEdenSpaceUsed ,max(ParEdenSpace_Used) as  maxParEdenSpaceUsed,min(ParEdenSpace_Committed) as  minParEdenSpace_Committed,max(ParEdenSpace_Committed) as  maxParEdenSpace_Committed,,max(ParEdenSpace_Max) as  maxParEdenSpace_Max

Log file

2017-06-26T02:10:12 [INFO] [Thread: Security Console] Memory pool configuration:
                               |       Init |       Used |  Committed |        Max |
Code Cache                     |     2.4 MB |    46.8 MB |    48.9 MB |     240 MB |
Metaspace                      |    0 bytes |    90.3 MB |    92.2 MB |   -1 bytes |
Par Eden Space                 |     6.5 MB |   204.6 MB |     1.7 GB |    12.8 GB |
Par Survivor Space             |     768 KB |    0 bytes |   221.2 MB |     1.6 GB |
CMS Old Gen                    |     248 MB |     2.1 GB |     4.3 GB |      32 GB |

Many thanks for your response!
much appreciated

0 Karma
1 Solution

elliotproebstel
Champion

To make it easy to understand (because you weren't sure if you'd convert to GB or MB above), I'll propose a way to normalize to bytes. This approach will split each relevant field into two pieces - val and multiplier. Based on the value of the field multiplier, a case statement multiplies the val by 1024 (to convert from KB), 1024*1024 (to convert from MB), 1024*1024*1024 (to convert from GB), or by no multiplier (to keep bytes in bytes).

| foreach minParEdenSpaceUsed, maxParEdenSpaceUsed, minParEdenSpace_Committed, maxParEdenSpace_Committed, maxParEdenSpace_Max 
    [ eval <<FIELD>>=split('<<FIELD>>', " ") 
    | eval val=mvindex(<<FIELD>>, 0), multiplier=mvindex(<<FIELD>>, 1) 
    | eval <<FIELD>>=case(multiplier="bytes", val, multiplier="KB", val*1024, multiplier="MB", val*1024*1024, multiplier="GB", val*1024*1024*1024) 
    | fields - val multiplier ]

If you wanted to convert to GB or MB, you'd adjust that math accordingly.

View solution in original post

0 Karma

elliotproebstel
Champion

To make it easy to understand (because you weren't sure if you'd convert to GB or MB above), I'll propose a way to normalize to bytes. This approach will split each relevant field into two pieces - val and multiplier. Based on the value of the field multiplier, a case statement multiplies the val by 1024 (to convert from KB), 1024*1024 (to convert from MB), 1024*1024*1024 (to convert from GB), or by no multiplier (to keep bytes in bytes).

| foreach minParEdenSpaceUsed, maxParEdenSpaceUsed, minParEdenSpace_Committed, maxParEdenSpace_Committed, maxParEdenSpace_Max 
    [ eval <<FIELD>>=split('<<FIELD>>', " ") 
    | eval val=mvindex(<<FIELD>>, 0), multiplier=mvindex(<<FIELD>>, 1) 
    | eval <<FIELD>>=case(multiplier="bytes", val, multiplier="KB", val*1024, multiplier="MB", val*1024*1024, multiplier="GB", val*1024*1024*1024) 
    | fields - val multiplier ]

If you wanted to convert to GB or MB, you'd adjust that math accordingly.

0 Karma

smdasim
Explorer

Hi Ellio,
thank you very much and much appreciated for your help in this regard !
Regards,
smdasim

0 Karma

smdasim
Explorer

sometime the same field value has value in KB,MB and GB .ParEdenSpace_Used can have values like 294.9 KB,2G B ,1.9 MB etc

0 Karma

somesoni2
Revered Legend

If you do following search, what output (value) you get for various fields? Can you post some sample results from below query?

your base search | head 1 | table ParEdenSpace_Used ParEdenSpace_Used  ParEdenSpace_Committed ParEdenSpace_Committed ParEdenSpace_Max
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...