Splunk Search
Highlighted

calculating average

Explorer

Need some help on search string to calculate 10 minute average and generate alert.
say for example Virtual memory usage 10 minute average > 10000 generate an alert. How can we calculate 10 minute average ?
this would be from a table event so need to use multikv. sample event below :

USER               PID   PSR   pctCPU       CPUTIME  pctMEM     RSZ_KB     VSZ_KB   TTY      S       ELAPSED  COMMAND             ARGS
root                 1     1      0.0      00:00:16     0.0        788      10384   ?        S   19-08:11:30  init                [3]
root                 2     1      0.0      00:00:00     0.0          0          0   ?        S   19-08:11:30  [kthreadd]          <noArgs>
root                 3     0      0.0      00:00:00     0.0          0          0   ?        S   19-08:11:30  [migration/0]       <noArgs>
root                 4     0      0.0      00:00:00     0.0          0          0   ?        S   19-08:11:30  [ksoftirqd/0]       <noArgs>
root                 5     0      0.0      00:00:26     0.0          0          0   ?        S   19-08:11:30  [events/0]          <noArgs>
root                 6     0      0.0      00:00:00     0.0          0          0   ?        S   19-08:11:30  [cpuset]            <noArgs

thanks
pmr

Tags (1)
0 Karma
Highlighted

Re: calculating average

Explorer

Folks,
Any help on this ?

-pmr

0 Karma
Highlighted

Re: calculating average

Motivator

The sample is ps output. Assuming you get the ps output every minutes or so. Virtual memory usage is VSZ_KB per PID in the event. You can run the following search every 10 minutes and set the alert when there is events more than one;

sourcetype=ps earliest=-11m@m latest=-1m@m
   | multikv fields VSZ_KB PID
   | chart avg(VSZ_KB) AS AvgSizeKB by PID 
   | where AvgSizeKB > 10000 
   | sort - AvgSizeKB
0 Karma
Highlighted

Re: calculating average

Explorer

thank you.. works perfect.

-pmr

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.