Splunk Search

What does the "Value" variable in my memory collection logs mean?

drizzo
Path Finder

When I enter In my the following into my Search...

 index=* host=* sourcetype="Perfmon"Memory" collection=Memory object=Memory counter="% Committed Bytes In Use"

I receive logs containing information about memory usage. However, there is a variable called, Value. I'm assuming it has to do something with how many bytes are being committed... maybe? It would have to be too low of an actual value though; just seven bytes being used? Impossibly small.

My end goal is to have a Time Chart of all the PC on my network with memory usage from the past 24 hours.

I tried to look this up through Splunk Answers, Splunk Docs, and Window's Technet, but with no avail. Any assistance would be lovely.

Example of Log:

07/24/2017 12:43:45.233 -0400
collection=Memory
object=Memory
counter="% Committed Bytes in Use"
instance=0
Value=7.0622917708150004
0 Karma
1 Solution

niketn
Legend

Since the performance counter you have chosen is % Committed Bytes In Use, a Value of 7.06% is the percent of total memory available. Windows Technet has details on this: https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/.

You can also compare these values/performance counters using Performance Monitor in Windows Start > run > perfmon

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Since the performance counter you have chosen is % Committed Bytes In Use, a Value of 7.06% is the percent of total memory available. Windows Technet has details on this: https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/.

You can also compare these values/performance counters using Performance Monitor in Windows Start > run > perfmon

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...