Splunk Search

How to get the peak total memory usage splitt by day

ajromero
Path Finder

Hi,

How can I make this search to display the peak by day

index=* sourcetype=Perfmon:Memory host=* |timechart span=7d | stats sparkline(avg(windows_mem_free)) as Trend avg(windows_mem_free) as Average, max(windows_mem_free) as Peak , latest(windows_mem_free) as Current, latest(_time) as "Last Updated" by host | convert ctime("Last Updated") | eval Peak=round((Peak)/1000,2) | eval Current=round((Current)/1000,2) | eval Average=round((Average)/1000,2)

 

Thank you,

 

Labels (3)
Tags (2)
0 Karma
1 Solution

ajromero
Path Finder

that worked but now I'm trying to convert the result to gigabytes

I tried this but it doesn't do it

| timechart span=1d max(windows_mem_free) as Peak by host |eval Peak=round((Peak/1024/1024/1024),2)

View solution in original post

0 Karma

ajromero
Path Finder

that worked but now I'm trying to convert the result to gigabytes

I tried this but it doesn't do it

| timechart span=1d max(windows_mem_free) as Peak by host |eval Peak=round((Peak/1024/1024/1024),2)

0 Karma

bowesmana
SplunkTrust
SplunkTrust

That search is not a valid search as the timechart has no aggregations

If you want to show peak of windows_mem_free by day, just do

index=* sourcetype=Perfmon:Memory host=*
| timechart span=1d max(windows_mem_free) as Peak by host 

if you want to show it by host

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...