Splunk Search

How can I write a search to display the average memory utilization over a 4 hour, 7 day, and 30 day period in different time spans?

idab
Path Finder

I am having problems calculating the average memory utilization over different time spans.

Not sure if I'm doing this the right way. I need ideas.

index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-7d |bucket span=1m  _time |stats  avg(Value) as AvgValue min(Value) as MinValue max(Value) as MaxValue by  _time host | dedup host | eval AvgValue = round(AvgValue/1024 ,1) | eval MinValue = round(MinValue/1024,1) | eval MaxValue = round(MaxValue/1024,1)
Tags (4)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Easiest option and easy to read will be this

 index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-30d  |stats  avg(Value) as AvgValue_Last30d min(Value) as MinValue_Last30d max(Value) as MaxValue_Last30d by  host | eval AvgValue_Last30d = round(AvgValue_Last30d/1024 ,1) | eval MinValue_Last30d = round(MinValue_Last30d/1024,1) | eval MaxValue_Last30d = round(MaxValue_Last30d/1024,1) 
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-7d  |stats  avg(Value) as AvgValue_Last7d min(Value) as MinValue_Last7d max(Value) as MaxValue_Last7d by  host  | eval AvgValue_Last7d = round(AvgValue_Last7d/1024 ,1) | eval MinValue_Last7d = round(MinValue_Last7d/1024,1) | eval MaxValue_Last7d = round(MaxValue_Last7d/1024,1)]
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-4h  |stats  avg(Value) as AvgValue_Last4h min(Value) as MinValue_Last4h max(Value) as MaxValue_Last4h by  host  | eval AvgValue_Last4h = round(AvgValue_Last4h/1024 ,1) | eval MinValue_Last4h = round(MinValue_Last4h/1024,1) | eval MaxValue_Last4h = round(MaxValue_Last4h/1024,1)] 
| stats values(*) as * by host

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Easiest option and easy to read will be this

 index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-30d  |stats  avg(Value) as AvgValue_Last30d min(Value) as MinValue_Last30d max(Value) as MaxValue_Last30d by  host | eval AvgValue_Last30d = round(AvgValue_Last30d/1024 ,1) | eval MinValue_Last30d = round(MinValue_Last30d/1024,1) | eval MaxValue_Last30d = round(MaxValue_Last30d/1024,1) 
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-7d  |stats  avg(Value) as AvgValue_Last7d min(Value) as MinValue_Last7d max(Value) as MaxValue_Last7d by  host  | eval AvgValue_Last7d = round(AvgValue_Last7d/1024 ,1) | eval MinValue_Last7d = round(MinValue_Last7d/1024,1) | eval MaxValue_Last7d = round(MaxValue_Last7d/1024,1)]
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-4h  |stats  avg(Value) as AvgValue_Last4h min(Value) as MinValue_Last4h max(Value) as MaxValue_Last4h by  host  | eval AvgValue_Last4h = round(AvgValue_Last4h/1024 ,1) | eval MinValue_Last4h = round(MinValue_Last4h/1024,1) | eval MaxValue_Last4h = round(MaxValue_Last4h/1024,1)] 
| stats values(*) as * by host

idab
Path Finder

Hi somesoni,

Is there a way to use the anomalies command to find the anomalies that exist for each variable in respect to _last 4 hours?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You want to show avg memory utilization (for a host OR all host) and show different column for last 4 hour, last 7 days and last 30 days period?

0 Karma

idab
Path Finder

Yes ! for a host and show different column for last 4 hour, last 7 days and last 30 days period.

Curious to see how its done for all host as well 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...