Splunk Search

Timechart function and graphing specific field?

letpeter
New Member

I would like to capture the value of used_memory_peak_human =>"26.28M" as it increases or decreases from all servers., in timechart or bar graph.
I have servers from app0-app7.

639 <14>1 2017-09-28T20:39:01.000+00:00 app0-test.labs.local test_ecp/traffic_worker 10837 - - sec=631141.354 sev=INFO pid=10837 tid=21127380 rid=0 GraphsRedisClient redis shard [3] info: {"tcp_port"=>"6203", "uptime_in_days"=>"9", "config_file"=>"/var/illumio_pce_data/runtime/config/redis-cache-3.conf", "connected_clients"=>"25", "used_memory_human"=>"23.26M", "used_memory_peak_human"=>"26.28M", "mem_fragmentation_ratio"=>"1.35", "expired_keys"=>"81780", "evicted_keys"=>"0", "keyspace_hits"=>"5955043", "keyspace_misses"=>"164053", "used_cpu_sys"=>"514.45", "used_cpu_user"=>"163.96", "db0"=>"keys=452,expires=413,avg_ttl=76297901"}

Thank you.
Peter

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

Your base search | rex "used_memory_peak_human\"\=\>\"(?<used_memory_peak_human>[\d\.]+)M" | timechart max(used_memory_peak_human) by host

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

Your base search | rex "used_memory_peak_human\"\=\>\"(?<used_memory_peak_human>[\d\.]+)M" | timechart max(used_memory_peak_human) by host
0 Karma

letpeter
New Member

Thank you very much, this is what I was looking.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...