Splunk Search

What does the "Value" variable in my memory collection logs mean?

drizzo
Path Finder

When I enter In my the following into my Search...

 index=* host=* sourcetype="Perfmon"Memory" collection=Memory object=Memory counter="% Committed Bytes In Use"

I receive logs containing information about memory usage. However, there is a variable called, Value. I'm assuming it has to do something with how many bytes are being committed... maybe? It would have to be too low of an actual value though; just seven bytes being used? Impossibly small.

My end goal is to have a Time Chart of all the PC on my network with memory usage from the past 24 hours.

I tried to look this up through Splunk Answers, Splunk Docs, and Window's Technet, but with no avail. Any assistance would be lovely.

Example of Log:

07/24/2017 12:43:45.233 -0400
collection=Memory
object=Memory
counter="% Committed Bytes in Use"
instance=0
Value=7.0622917708150004
0 Karma
1 Solution

niketn
Legend

Since the performance counter you have chosen is % Committed Bytes In Use, a Value of 7.06% is the percent of total memory available. Windows Technet has details on this: https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/.

You can also compare these values/performance counters using Performance Monitor in Windows Start > run > perfmon

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Since the performance counter you have chosen is % Committed Bytes In Use, a Value of 7.06% is the percent of total memory available. Windows Technet has details on this: https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/.

You can also compare these values/performance counters using Performance Monitor in Windows Start > run > perfmon

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...