Getting Data In

windows memory leaks

omprakash9998
Path Finder

Hi,

we Have been trying to detect any memory leaks on our windows servers. As of now we are just trying to compare the virtual bytes counter for two different time ranges and tracking the increase in the memory usage by a process.Later we are trying to detect patterns by saving the results in a lookupfile. Is there a better approach to achieve this.

Thanks

0 Karma

at1ll3y
New Member

Hi,
Could you provide your search queries?

0 Karma

omprakash9998
Path Finder
index=perfmon eventtype="perfmon_windows" (Host="*") Host="*" object=Process counter="Private_Bytes" earliest=-30m@m latest=-20m@m 
  | stats avg(Value) AS older  by host process_name 
  | join [search index=perfmon eventtype="perfmon_windows" (Host="*") Host="*" object=Process counter="Private_Bytes" earliest=-20m@m latest=-10m@m   | stats avg(Value) AS newer  by host process_name _time | convert ctime(_time) as time  ]  |eval diff= newer - older | eval percent = (diff/older)*100 
  |table host, process_name, older, newer, percent , time| where newer >  4 * older | sort - percent | outputlookup append=true autotestlookup.csv

this is our current search query to compare the memory and save it in a lookup file. I am not sure if the approach we are trying is the best option.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...