Dashboards & Visualizations
Highlighted

How to plot a bar chart to plot fields with KB,Bytes,MB and GB values?

New Member

Hi ,

I have split the below log into key value paris ParEdenSpace_init=6.5 MB ParEdenSpace_Used=204.6 ParEdenSpace_Commited=1.7 GB and ParEdenSpace_Max=12.8 GB.

I have used below query to plot the data, however, the minParEdenSpaceUsed value is in KB but it is showing high value in the graph attached. How would I normalize the values before I plot the data and how to identify if the value is in bytes, MB or GB and then convert into standard GB or MB.

timechart span=1d min(ParEdenSpace_Used) as minParEdenSpaceUsed ,max(ParEdenSpace_Used) as  maxParEdenSpaceUsed,min(ParEdenSpace_Committed) as  minParEdenSpace_Committed,max(ParEdenSpace_Committed) as  maxParEdenSpace_Committed,,max(ParEdenSpace_Max) as  maxParEdenSpace_Max

Log file

2017-06-26T02:10:12 [INFO] [Thread: Security Console] Memory pool configuration:
                               |       Init |       Used |  Committed |        Max |
Code Cache                     |     2.4 MB |    46.8 MB |    48.9 MB |     240 MB |
Metaspace                      |    0 bytes |    90.3 MB |    92.2 MB |   -1 bytes |
Par Eden Space                 |     6.5 MB |   204.6 MB |     1.7 GB |    12.8 GB |
Par Survivor Space             |     768 KB |    0 bytes |   221.2 MB |     1.6 GB |
CMS Old Gen                    |     248 MB |     2.1 GB |     4.3 GB |      32 GB |

Many thanks for your response!
much appreciated

0 Karma
Highlighted

Re: How to plot a bar chart to plot fields with KB,Bytes,MB and GB values?

New Member

sometime the same field value has value in KB,MB and GB .ParEdenSpace_Used can have values like 294.9 KB,2G B ,1.9 MB etc

0 Karma
Highlighted

Re: How to plot a bar chart to plot fields with KB,Bytes,MB and GB values?

SplunkTrust
SplunkTrust

If you do following search, what output (value) you get for various fields? Can you post some sample results from below query?

your base search | head 1 | table ParEdenSpace_Used ParEdenSpace_Used  ParEdenSpace_Committed ParEdenSpace_Committed ParEdenSpace_Max
0 Karma
Highlighted

Re: How to plot a bar chart to plot fields with KB,Bytes,MB and GB values?

To make it easy to understand (because you weren't sure if you'd convert to GB or MB above), I'll propose a way to normalize to bytes. This approach will split each relevant field into two pieces - val and multiplier. Based on the value of the field multiplier, a case statement multiplies the val by 1024 (to convert from KB), 10241024 (to convert from MB), 10241024*1024 (to convert from GB), or by no multiplier (to keep bytes in bytes).

| foreach minParEdenSpaceUsed, maxParEdenSpaceUsed, minParEdenSpace_Committed, maxParEdenSpace_Committed, maxParEdenSpace_Max 
    [ eval <<FIELD>>=split('<<FIELD>>', " ") 
    | eval val=mvindex(<<FIELD>>, 0), multiplier=mvindex(<<FIELD>>, 1) 
    | eval <<FIELD>>=case(multiplier="bytes", val, multiplier="KB", val*1024, multiplier="MB", val*1024*1024, multiplier="GB", val*1024*1024*1024) 
    | fields - val multiplier ]

If you wanted to convert to GB or MB, you'd adjust that math accordingly.

View solution in original post

0 Karma
Highlighted

Re: How to plot a bar chart to plot fields with KB,Bytes,MB and GB values?

New Member

Hi Ellio,
thank you very much and much appreciated for your help in this regard !
Regards,
smdasim

0 Karma