How would i need to modify the below query to get Memory value in percentage when the threshold exceeds 90. Kindly suggest
host=ABC* index=perfmon sourcetype="PerfmonMk:Memory" Available_Bytes=* Available_KBytes=* Available_MBytes=* | stats by _time, Available_MBytes | table _time, Available_MBytes
The following search reports the amount of physical memory in KB:
index=windows sourcetype=WinHostMon
| stats latest(TotalPhysicalMemoryKB) as TotalPhysicalMemoryKB, latest(TotalVirtualMemoryKB) as TotalVirtualMemoryKB by host | sort 0 host
Notes:
This requires the input “OperatingSystem” to be activated in your deployment, using:
[WinHostMon://OperatingSystem]
interval = 600
disabled = 1
type = OperatingSystem
index = windows
For the demonstration, let’s store this result in a temporarily lookup csv file:
index=windows sourcetype=WinHostMon
| stats latest(TotalPhysicalMemoryKB) as TotalPhysicalMemoryKB, latest(TotalVirtualMemoryKB) as TotalVirtualMemoryKB by host | sort 0 host
| outputlookup windows_memory_inventory.csv
Then, looking at the memory statistics, we have the amount of currently used volume of memory in KB, let’s map this with the inventory data and use some easy calculation:
index=perfmon sourcetype="PerfmonMk:Memory"
| eval used_memory_KB=coalesce('Available_KBytes', Value)
| lookup windows_memory_inventory.csv host as host OUTPUTNEW TotalPhysicalMemoryKB
| eval free_memory_pct=((used_memory_KB/TotalPhysicalMemoryKB)*100), used_memory_pct=(100-free_memory_pct)
| timechart avg(used_memory_pct) as used_memory_pct by host
~~I AM BACK