Splunk Search

How to edit my search to display a percentage in my table?

iatwal
Path Finder

What am I missing here? We have JVMs logging out to file every time there is a Garbage Collect, I'm trying to do a simple percentage of heap used calculation on the last Garbage Collection. I'm not getting the percentage in table format to work.

Search:

host="xxxx" heap_used=* total_heap_size=* | chart last(heap_used), last(total_heap_size) | eval percentage=(heap_used)/(total_heap_size)*100

heap_used and total_heap_size show up in the table, but no percentage...

0 Karma
1 Solution

somesoni2
Revered Legend

To be on safer side, do a numeric conversion of the heap_used and total_heap_size field

 host="xxxx" heap_used=* total_heap_size=* | chart latest(heap_used) as heap_used, latest(total_heap_size) as total_heap_size | eval percentage=tonumber(heap_used)*100/tonumber(total_heap_size)

View solution in original post

0 Karma

somesoni2
Revered Legend

To be on safer side, do a numeric conversion of the heap_used and total_heap_size field

 host="xxxx" heap_used=* total_heap_size=* | chart latest(heap_used) as heap_used, latest(total_heap_size) as total_heap_size | eval percentage=tonumber(heap_used)*100/tonumber(total_heap_size)
0 Karma

iatwal
Path Finder

ok this worked! the values were coming us alphanumeric instead of numerical... did this: convert num

0 Karma

sundareshr
Legend

Try this

host="xxxx" heap_used=* total_heap_size=* | head 1 | eval percentage=heap_used/total_heap_size*100 | table heap_used total_heap_size percentage

*If you want this by host, then try this*

host=* heap_used=* total_heap_size=* | stats last(heap_used) as heap_used last(total_heap_size) as total_heap_size by host | eval percentage=heap_used/total_heap_size*100 
0 Karma

skoelpin
SplunkTrust
SplunkTrust
host="xxxx" heap_used= total_heap_size= | chart last(heap_used), last(total_heap_size) | eval percentage=(heap_used)/(total_heap_size)*100 | table heap_used total_heap_size percentage 
0 Karma

iatwal
Path Finder

I tried this but I'm still not getting a value for percentage.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...