Splunk Search

Timechart function and graphing specific field?

letpeter
New Member

I would like to capture the value of used_memory_peak_human =>"26.28M" as it increases or decreases from all servers., in timechart or bar graph.
I have servers from app0-app7.

639 <14>1 2017-09-28T20:39:01.000+00:00 app0-test.labs.local test_ecp/traffic_worker 10837 - - sec=631141.354 sev=INFO pid=10837 tid=21127380 rid=0 GraphsRedisClient redis shard [3] info: {"tcp_port"=>"6203", "uptime_in_days"=>"9", "config_file"=>"/var/illumio_pce_data/runtime/config/redis-cache-3.conf", "connected_clients"=>"25", "used_memory_human"=>"23.26M", "used_memory_peak_human"=>"26.28M", "mem_fragmentation_ratio"=>"1.35", "expired_keys"=>"81780", "evicted_keys"=>"0", "keyspace_hits"=>"5955043", "keyspace_misses"=>"164053", "used_cpu_sys"=>"514.45", "used_cpu_user"=>"163.96", "db0"=>"keys=452,expires=413,avg_ttl=76297901"}

Thank you.
Peter

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

Your base search | rex "used_memory_peak_human\"\=\>\"(?<used_memory_peak_human>[\d\.]+)M" | timechart max(used_memory_peak_human) by host

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

Your base search | rex "used_memory_peak_human\"\=\>\"(?<used_memory_peak_human>[\d\.]+)M" | timechart max(used_memory_peak_human) by host
0 Karma

letpeter
New Member

Thank you very much, this is what I was looking.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...