Splunk Search

What does the "Value" variable in my memory collection logs mean?

drizzo
Path Finder

When I enter In my the following into my Search...

 index=* host=* sourcetype="Perfmon"Memory" collection=Memory object=Memory counter="% Committed Bytes In Use"

I receive logs containing information about memory usage. However, there is a variable called, Value. I'm assuming it has to do something with how many bytes are being committed... maybe? It would have to be too low of an actual value though; just seven bytes being used? Impossibly small.

My end goal is to have a Time Chart of all the PC on my network with memory usage from the past 24 hours.

I tried to look this up through Splunk Answers, Splunk Docs, and Window's Technet, but with no avail. Any assistance would be lovely.

Example of Log:

07/24/2017 12:43:45.233 -0400
collection=Memory
object=Memory
counter="% Committed Bytes in Use"
instance=0
Value=7.0622917708150004
0 Karma
1 Solution

niketn
Legend

Since the performance counter you have chosen is % Committed Bytes In Use, a Value of 7.06% is the percent of total memory available. Windows Technet has details on this: https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/.

You can also compare these values/performance counters using Performance Monitor in Windows Start > run > perfmon

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Since the performance counter you have chosen is % Committed Bytes In Use, a Value of 7.06% is the percent of total memory available. Windows Technet has details on this: https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/.

You can also compare these values/performance counters using Performance Monitor in Windows Start > run > perfmon

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...