Splunk Search

How can I write a search to display the average memory utilization over a 4 hour, 7 day, and 30 day period in different time spans?

idab
Path Finder

I am having problems calculating the average memory utilization over different time spans.

Not sure if I'm doing this the right way. I need ideas.

index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-7d |bucket span=1m  _time |stats  avg(Value) as AvgValue min(Value) as MinValue max(Value) as MaxValue by  _time host | dedup host | eval AvgValue = round(AvgValue/1024 ,1) | eval MinValue = round(MinValue/1024,1) | eval MaxValue = round(MaxValue/1024,1)
Tags (4)
1 Solution

somesoni2
Revered Legend

Easiest option and easy to read will be this

 index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-30d  |stats  avg(Value) as AvgValue_Last30d min(Value) as MinValue_Last30d max(Value) as MaxValue_Last30d by  host | eval AvgValue_Last30d = round(AvgValue_Last30d/1024 ,1) | eval MinValue_Last30d = round(MinValue_Last30d/1024,1) | eval MaxValue_Last30d = round(MaxValue_Last30d/1024,1) 
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-7d  |stats  avg(Value) as AvgValue_Last7d min(Value) as MinValue_Last7d max(Value) as MaxValue_Last7d by  host  | eval AvgValue_Last7d = round(AvgValue_Last7d/1024 ,1) | eval MinValue_Last7d = round(MinValue_Last7d/1024,1) | eval MaxValue_Last7d = round(MaxValue_Last7d/1024,1)]
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-4h  |stats  avg(Value) as AvgValue_Last4h min(Value) as MinValue_Last4h max(Value) as MaxValue_Last4h by  host  | eval AvgValue_Last4h = round(AvgValue_Last4h/1024 ,1) | eval MinValue_Last4h = round(MinValue_Last4h/1024,1) | eval MaxValue_Last4h = round(MaxValue_Last4h/1024,1)] 
| stats values(*) as * by host

View solution in original post

somesoni2
Revered Legend

Easiest option and easy to read will be this

 index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-30d  |stats  avg(Value) as AvgValue_Last30d min(Value) as MinValue_Last30d max(Value) as MaxValue_Last30d by  host | eval AvgValue_Last30d = round(AvgValue_Last30d/1024 ,1) | eval MinValue_Last30d = round(MinValue_Last30d/1024,1) | eval MaxValue_Last30d = round(MaxValue_Last30d/1024,1) 
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-7d  |stats  avg(Value) as AvgValue_Last7d min(Value) as MinValue_Last7d max(Value) as MaxValue_Last7d by  host  | eval AvgValue_Last7d = round(AvgValue_Last7d/1024 ,1) | eval MinValue_Last7d = round(MinValue_Last7d/1024,1) | eval MaxValue_Last7d = round(MaxValue_Last7d/1024,1)]
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-4h  |stats  avg(Value) as AvgValue_Last4h min(Value) as MinValue_Last4h max(Value) as MaxValue_Last4h by  host  | eval AvgValue_Last4h = round(AvgValue_Last4h/1024 ,1) | eval MinValue_Last4h = round(MinValue_Last4h/1024,1) | eval MaxValue_Last4h = round(MaxValue_Last4h/1024,1)] 
| stats values(*) as * by host

idab
Path Finder

Hi somesoni,

Is there a way to use the anomalies command to find the anomalies that exist for each variable in respect to _last 4 hours?

0 Karma

somesoni2
Revered Legend

You want to show avg memory utilization (for a host OR all host) and show different column for last 4 hour, last 7 days and last 30 days period?

0 Karma

idab
Path Finder

Yes ! for a host and show different column for last 4 hour, last 7 days and last 30 days period.

Curious to see how its done for all host as well 😉

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...