Splunk Search

Using a parameter that records memory usage, how do I get my transaction search to show the maximum memory usage by user?

DanielFordWA
Contributor

Hi,

I have a parameter system_mem that records the memory usage of an application.

I am trying to do analysis by using transactions and see each session, for the previous 100 events or so, leading up to the max memory usage.

Is it possible to have something like the search below? Currently, my transactions do not end with the maximum system_mem experienced by the user. Why is this?

index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") |  transaction GUID maxpause=60min endswith=(eventstats=max(system_mem)) mvlist=t keepevicted=true | table GUID c_time cs_uri_stem system_mem

To note I do not have a sessionId, only a unique user ID.

Thanks,

Dan

0 Karma

thirumalreddyb
Communicator

Please try this.

index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") | eventstats max(system_mem) as max_mem, min(system_mem) as min_mem by GUID | search system_mem=max_mem OR system_mem=min_mem | fields - max_mem, min_mem | transaction GUID mvlist=t keepevicted=true | table GUID c_time cs_uri_stem system_mem

Hope it helps you.

0 Karma

woodcock
Esteemed Legend

If I understand you correctly and we are assuming that a "session" can be inferred by an increase of memory usage (e.g. so long as memory is increasing, it is the same session; whenever it decreases, a new session has begun), then we can manufacture a sessionID using streamstats like this:

index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") | reverse | streamstats current=f last(system_mem) AS prev_system_mem BY GUID | eval new_session=if((system_mem<prev_system_mem),"TRUE",null()) | streamstats current=t count(new_session) AS sessionID BY GUID

Now each GUID's event has a sessionID field that can be used to distinguish/group events that can be exploited by tacking on something like | stats blah blah blah BY GUID sessionID.

Any time that you can avoid transaction, you should; it is very slow/costly to use it.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...