Splunk Search

How to edit my search to create a memory utilization dashboard for Windows machines?

vn86893
Explorer

I am trying to set up a Memory utilization dashboard for Windows machines. I did try to set up the dashboard but I am able to get it only to a stage where I can set up dashboard for memory available. But I need metrics for memory utilized by time.

Here is what I am trying

index=**** sourcetype="Perfmon:Available Memory"  | bucket _time span=15m | eval gigabytes=(((Value/1024)/1024)/1024) | eval GB=round(gigabytes, 2) | timechart avg(GB) by host limit=0

Any help is greatly appreciated.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

1) There is no point to bin _time before timechart. Timechart will bin for you automatically.

2) On my system, the sourcetype is "Perfmon:Memory" and the counter (for example) is "Available MBytes". review your data to be sure of the sourcetype and counter name.

3) When you divide before averaging, your rounding errors will accumulate. Better to average, then divide. In this case, I've used the MBytes, so there is only one level of division.

 index=perfmon sourcetype="Perfmon:Available Memory"  counter= "Available MBytes"
| timechart span=15m avg(Value) by host limit=0
| foreach * [ eval <<FIELD>>=round( (<<FIELD>>/1024/1024/1024),2)]

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) There is no point to bin _time before timechart. Timechart will bin for you automatically.

2) On my system, the sourcetype is "Perfmon:Memory" and the counter (for example) is "Available MBytes". review your data to be sure of the sourcetype and counter name.

3) When you divide before averaging, your rounding errors will accumulate. Better to average, then divide. In this case, I've used the MBytes, so there is only one level of division.

 index=perfmon sourcetype="Perfmon:Available Memory"  counter= "Available MBytes"
| timechart span=15m avg(Value) by host limit=0
| foreach * [ eval <<FIELD>>=round( (<<FIELD>>/1024/1024/1024),2)]
0 Karma

adonio
Ultra Champion

are you collecting the perfmon metrics for memory utilization?
your search overall is on the right track ...
you can consolidate the evals
... | eval GB = round(Value/1024/1024/1024, 2)
also, pay attention to the counter field in the perfmon data

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...