Splunk Search

How to edit my search to create a memory utilization dashboard for Windows machines?

vn86893
Explorer

I am trying to set up a Memory utilization dashboard for Windows machines. I did try to set up the dashboard but I am able to get it only to a stage where I can set up dashboard for memory available. But I need metrics for memory utilized by time.

Here is what I am trying

index=**** sourcetype="Perfmon:Available Memory"  | bucket _time span=15m | eval gigabytes=(((Value/1024)/1024)/1024) | eval GB=round(gigabytes, 2) | timechart avg(GB) by host limit=0

Any help is greatly appreciated.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

1) There is no point to bin _time before timechart. Timechart will bin for you automatically.

2) On my system, the sourcetype is "Perfmon:Memory" and the counter (for example) is "Available MBytes". review your data to be sure of the sourcetype and counter name.

3) When you divide before averaging, your rounding errors will accumulate. Better to average, then divide. In this case, I've used the MBytes, so there is only one level of division.

 index=perfmon sourcetype="Perfmon:Available Memory"  counter= "Available MBytes"
| timechart span=15m avg(Value) by host limit=0
| foreach * [ eval <<FIELD>>=round( (<<FIELD>>/1024/1024/1024),2)]

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) There is no point to bin _time before timechart. Timechart will bin for you automatically.

2) On my system, the sourcetype is "Perfmon:Memory" and the counter (for example) is "Available MBytes". review your data to be sure of the sourcetype and counter name.

3) When you divide before averaging, your rounding errors will accumulate. Better to average, then divide. In this case, I've used the MBytes, so there is only one level of division.

 index=perfmon sourcetype="Perfmon:Available Memory"  counter= "Available MBytes"
| timechart span=15m avg(Value) by host limit=0
| foreach * [ eval <<FIELD>>=round( (<<FIELD>>/1024/1024/1024),2)]
0 Karma

adonio
Ultra Champion

are you collecting the perfmon metrics for memory utilization?
your search overall is on the right track ...
you can consolidate the evals
... | eval GB = round(Value/1024/1024/1024, 2)
also, pay attention to the counter field in the perfmon data

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...