Splunk Search

How to edit my search to display a percentage in my table?

iatwal
Path Finder

What am I missing here? We have JVMs logging out to file every time there is a Garbage Collect, I'm trying to do a simple percentage of heap used calculation on the last Garbage Collection. I'm not getting the percentage in table format to work.

Search:

host="xxxx" heap_used=* total_heap_size=* | chart last(heap_used), last(total_heap_size) | eval percentage=(heap_used)/(total_heap_size)*100

heap_used and total_heap_size show up in the table, but no percentage...

0 Karma
1 Solution

somesoni2
Revered Legend

To be on safer side, do a numeric conversion of the heap_used and total_heap_size field

 host="xxxx" heap_used=* total_heap_size=* | chart latest(heap_used) as heap_used, latest(total_heap_size) as total_heap_size | eval percentage=tonumber(heap_used)*100/tonumber(total_heap_size)

View solution in original post

0 Karma

somesoni2
Revered Legend

To be on safer side, do a numeric conversion of the heap_used and total_heap_size field

 host="xxxx" heap_used=* total_heap_size=* | chart latest(heap_used) as heap_used, latest(total_heap_size) as total_heap_size | eval percentage=tonumber(heap_used)*100/tonumber(total_heap_size)
0 Karma

iatwal
Path Finder

ok this worked! the values were coming us alphanumeric instead of numerical... did this: convert num

0 Karma

sundareshr
Legend

Try this

host="xxxx" heap_used=* total_heap_size=* | head 1 | eval percentage=heap_used/total_heap_size*100 | table heap_used total_heap_size percentage

*If you want this by host, then try this*

host=* heap_used=* total_heap_size=* | stats last(heap_used) as heap_used last(total_heap_size) as total_heap_size by host | eval percentage=heap_used/total_heap_size*100 
0 Karma

skoelpin
SplunkTrust
SplunkTrust
host="xxxx" heap_used= total_heap_size= | chart last(heap_used), last(total_heap_size) | eval percentage=(heap_used)/(total_heap_size)*100 | table heap_used total_heap_size percentage 
0 Karma

iatwal
Path Finder

I tried this but I'm still not getting a value for percentage.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...