Splunk Search

How can I write a search to display the average memory utilization over a 4 hour, 7 day, and 30 day period in different time spans?

idab
Path Finder

I am having problems calculating the average memory utilization over different time spans.

Not sure if I'm doing this the right way. I need ideas.

index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-7d |bucket span=1m  _time |stats  avg(Value) as AvgValue min(Value) as MinValue max(Value) as MaxValue by  _time host | dedup host | eval AvgValue = round(AvgValue/1024 ,1) | eval MinValue = round(MinValue/1024,1) | eval MaxValue = round(MaxValue/1024,1)
Tags (4)
1 Solution

somesoni2
Revered Legend

Easiest option and easy to read will be this

 index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-30d  |stats  avg(Value) as AvgValue_Last30d min(Value) as MinValue_Last30d max(Value) as MaxValue_Last30d by  host | eval AvgValue_Last30d = round(AvgValue_Last30d/1024 ,1) | eval MinValue_Last30d = round(MinValue_Last30d/1024,1) | eval MaxValue_Last30d = round(MaxValue_Last30d/1024,1) 
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-7d  |stats  avg(Value) as AvgValue_Last7d min(Value) as MinValue_Last7d max(Value) as MaxValue_Last7d by  host  | eval AvgValue_Last7d = round(AvgValue_Last7d/1024 ,1) | eval MinValue_Last7d = round(MinValue_Last7d/1024,1) | eval MaxValue_Last7d = round(MaxValue_Last7d/1024,1)]
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-4h  |stats  avg(Value) as AvgValue_Last4h min(Value) as MinValue_Last4h max(Value) as MaxValue_Last4h by  host  | eval AvgValue_Last4h = round(AvgValue_Last4h/1024 ,1) | eval MinValue_Last4h = round(MinValue_Last4h/1024,1) | eval MaxValue_Last4h = round(MaxValue_Last4h/1024,1)] 
| stats values(*) as * by host

View solution in original post

somesoni2
Revered Legend

Easiest option and easy to read will be this

 index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-30d  |stats  avg(Value) as AvgValue_Last30d min(Value) as MinValue_Last30d max(Value) as MaxValue_Last30d by  host | eval AvgValue_Last30d = round(AvgValue_Last30d/1024 ,1) | eval MinValue_Last30d = round(MinValue_Last30d/1024,1) | eval MaxValue_Last30d = round(MaxValue_Last30d/1024,1) 
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-7d  |stats  avg(Value) as AvgValue_Last7d min(Value) as MinValue_Last7d max(Value) as MaxValue_Last7d by  host  | eval AvgValue_Last7d = round(AvgValue_Last7d/1024 ,1) | eval MinValue_Last7d = round(MinValue_Last7d/1024,1) | eval MaxValue_Last7d = round(MaxValue_Last7d/1024,1)]
| append [search index=perfmon counter="Available MBytes"  collection=Memory host=megatron earliest=-4h  |stats  avg(Value) as AvgValue_Last4h min(Value) as MinValue_Last4h max(Value) as MaxValue_Last4h by  host  | eval AvgValue_Last4h = round(AvgValue_Last4h/1024 ,1) | eval MinValue_Last4h = round(MinValue_Last4h/1024,1) | eval MaxValue_Last4h = round(MaxValue_Last4h/1024,1)] 
| stats values(*) as * by host

idab
Path Finder

Hi somesoni,

Is there a way to use the anomalies command to find the anomalies that exist for each variable in respect to _last 4 hours?

0 Karma

somesoni2
Revered Legend

You want to show avg memory utilization (for a host OR all host) and show different column for last 4 hour, last 7 days and last 30 days period?

0 Karma

idab
Path Finder

Yes ! for a host and show different column for last 4 hour, last 7 days and last 30 days period.

Curious to see how its done for all host as well 😉

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...