Using a parameter that records memory usage, how do I get my transaction search to show the maximum memory usage by user?

[DanielFordWA]

Hi,

I have a parameter system_mem that records the memory usage of an application.

I am trying to do analysis by using transactions and see each session, for the previous 100 events or so, leading up to the max memory usage.

Is it possible to have something like the search below? Currently, my transactions do not end with the maximum system_mem experienced by the user. Why is this?

index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") |  transaction GUID maxpause=60min endswith=(eventstats=max(system_mem)) mvlist=t keepevicted=true | table GUID c_time cs_uri_stem system_mem

To note I do not have a sessionId, only a unique user ID.

Thanks,

Dan

[thirumalreddyb]

Please try this.

index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") | eventstats max(system_mem) as max_mem, min(system_mem) as min_mem by GUID | search system_mem=max_mem OR system_mem=min_mem | fields - max_mem, min_mem | transaction GUID mvlist=t keepevicted=true | table GUID c_time cs_uri_stem system_mem

Hope it helps you.

[woodcock]

If I understand you correctly and we are assuming that a "session" can be inferred by an increase of memory usage (e.g. so long as memory is increasing, it is the same session; whenever it decreases, a new session has begun), then we can manufacture a sessionID using streamstats like this:

index=iis earliest=-7d@d latest=@d | eval c_time=_time | eval c_time=strftime(_time,"%Y-%m-%d %H:%M:%S") | reverse | streamstats current=f last(system_mem) AS prev_system_mem BY GUID | eval new_session=if((system_mem<prev_system_mem),"TRUE",null()) | streamstats current=t count(new_session) AS sessionID BY GUID

Now each GUID's event has a sessionID field that can be used to distinguish/group events that can be exploited by tacking on something like | stats blah blah blah BY GUID sessionID.

Any time that you can avoid transaction, you should; it is very slow/costly to use it.