Splunk Search

Memory usage 100% stacked graphs for multiple servers?

dang
Path Finder

Based on Stephen Sorkin's advice here, I'm attempting to create some 100% stacked graphs for memory usage across a number of servers.

Here's what I have working for a single server:

index=data ComputerName=Server01 source=WMI:Server_Memory | eval FreeGB=AvailableBytes/1024/1024/1024 | eval UsedGB=CommittedBytes/1024/1024/1024 | timechart span=5min median(FreeGB) median(UsedGB)

The problem I'm having is splitting this out by ComputerName. Any recommendations are appreciated

Tags (3)
0 Karma
1 Solution

jonuwz
Influencer

Should be as simple as this :

index=data ComputerName=* source=WMI:Server_Memory | eval FreeGB=AvailableBytes/1024/1024/1024 | eval UsedGB=CommittedBytes/1024/1024/1024 | timechart span=5min median(FreeGB) median(UsedGB) by ComputerName

Depending on the number of servers, you might need to experiment with limit=X as an option to the timechart

John

View solution in original post

jonuwz
Influencer

Thats tough.

You can have 2 stacked charts per time interval, if you use flashcharts, duplicate the Yaxis, and set the spacing to 0 and 0.5.

Anything more than 2 Y axis and the bars overlap (you can't control the width of the bars, only the spacing between them)

I'm guessing you have more than 2 servers though ...

This :

index=data ComputerName=* source=WMI:Server_Memory | eval FreeGB=AvailableBytes/1024/1024/1024 | eval UsedGB=CommittedBytes/1024/1024/1024 | timechart span=5min median(FreeGB) median(UsedGB) by ComputerName

Just gives you a jumble of lines.

I'd go with a summary chart showing free memory % per server over time.

Then have a separate chart, with a dropdown list of servers, that shows the stacked free and used memory over time for the selected server.

Be interesting to hear some other options..

John

0 Karma

jonuwz
Influencer

Very likely. On 4.3.2 you can't specify the span if you have multiple series. Its valid on 4.3.3 though.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This looks like there has been an enhancement was made in version 4.3. to have timechart automatically do what used to require the xyseries technique.

0 Karma

jonuwz
Influencer

Odd. - the scenario listed is valid and works, though I distinctly remember this failing for me before..

index=_internal series=splunk* kbps > 0 eps > 0 | timechart span=1m avg(kbps) as throughput avg(eps) as load by series

gives the same results as this (apart from the legend)

same_base_search | bin_time span=1m | stats avg(kbps) as kbps avg(eps) as eps by series _time | eval s1="throughput load" | makemv s1 | mvexpand s1 | eval yval=case(s1=="throughput",kbps,s1=="load",eps) | eval chart_series=series+":"+s1 | xyseries _time,chart_series,yval | makecontinuous _time

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

If you did need a timechart, you would have to use something like this: http://docs.splunk.com/Documentation/Splunk/latest/User/ReportOfMultipleDataSeries

0 Karma

jonuwz
Influencer

Should be as simple as this :

index=data ComputerName=* source=WMI:Server_Memory | eval FreeGB=AvailableBytes/1024/1024/1024 | eval UsedGB=CommittedBytes/1024/1024/1024 | timechart span=5min median(FreeGB) median(UsedGB) by ComputerName

Depending on the number of servers, you might need to experiment with limit=X as an option to the timechart

John

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee
0 Karma

jonuwz
Influencer

Ah - I thought you needed a timeseries ( based on the other question you linked.

You can have 2 stacked charts per time interval, if you use flashcharts, duplicate the Yaxis, and set the spacing to 0 and 0.5.

Anything more than 2 Y-axes and the bars overlap and it looks rubbish.

I'm guessing you have more than 2 servers though ...

0 Karma

dang
Path Finder

Actually, it's very close to being that simple. I figured it out once I was able to stop multitasking with other things. The trick is to not use "timechart" but to use "chart" like this:

 index=data ComputerName=Server* source=WMI:Server_Memory | eval FreeGB=AvailableBytes/1024/1024/1024 | eval UsedGB=CommittedBytes/1024/1024/1024 | chart median(FreeGB) median(UsedGB) by ComputerName

Limiting the result set is definitely something we'll need to do, but that's got us well on the way. Thanks John.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!