sourcetype=splunklog metric="memory"|rex field=_raw "(?i)memory-used\s+(?P\d+)" |rex field=_raw "(?i)memory-buffered\s+(?P\d+)" |rex "(?i)memory-cached\s+(?P\d+)"|rex "(?i)memory-slab_unrecl\s+(?P\d+)"|rex "(?i)memory-slab_recl\s+(?P\d+)"| eval sum=(val+val1+val2+val3+val4) | table sum val1 val2 val3
its not adding the value, but shows the individual value fine. Can one one please help me ??
It looks like not all the val are getting populated for each events (could be null). Try this
sourcetype=splunklog metric="memory"|rex field=_raw "(?i)memory-used\s+(?P<val>\d+)" |rex field=_raw "(?i)memory-buffered\s+(?P<val1>\d+)" |rex "(?i)memory-cached\s+(?P<val2>\d+)"|rex "(?i)memory-slab_unrecl\s+(?P<val3>\d+)"|rex "(?i)memory-slab_recl\s+(?P<val4>\d+)" | fillnull value=0 val* | eval sum=(val+val1+val2+val3+val4) | table sum val1 val2 val3
OR
sourcetype=splunklog metric="memory"|rex field=_raw "(?i)memory-used\s+(?P<val>\d+)" |rex field=_raw "(?i)memory-buffered\s+(?P<val1>\d+)" |rex "(?i)memory-cached\s+(?P<val2>\d+)"|rex "(?i)memory-slab_unrecl\s+(?P<val3>\d+)"|rex "(?i)memory-slab_recl\s+(?P<val4>\d+)" | eval sum=(coalesce(val,0)+coalesce(val1,0)+coalesce(val2,0)+coalesce(val3,0)+coalesce(val4,0)) | table sum val1 val2 val3