Splunk Search

create a listing of min(foo) and _time

dang
Path Finder

I'm thinking what I'm trying to do is actually simple, I'm just not understanding the fundamental concept I need to use. I am looking at memory data for a collection of servers and starting my search like this:

index=main ComputerName=* sourcetype=WMI* AvailableMBytes

What I'm trying to do is create a list of information (and intentionally not using the words "chart" or "table", but I think that's where this is leading) where I present the values for "_time" and "min(AvailableBytes)" to show only the times each server have the lowest amount of available bytes of memory, with one row per server name.

Any suggestions?

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

This can be achieved in several ways, one of them being

your search | sort AvailableMBytes | dedup host | table _time host AvailableMBytes

A subsearch could be another way of doing it

index=main sourcetype=WMI* [search index=main sourcetype=WMI* AvailableMBytes | stats min(AvailableMBytes) AS AvailableMBytes by host | fields + AvailableMBytes, host ] | table _time, host, AvailableMBytes

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

This can be achieved in several ways, one of them being

your search | sort AvailableMBytes | dedup host | table _time host AvailableMBytes

A subsearch could be another way of doing it

index=main sourcetype=WMI* [search index=main sourcetype=WMI* AvailableMBytes | stats min(AvailableMBytes) AS AvailableMBytes by host | fields + AvailableMBytes, host ] | table _time, host, AvailableMBytes

Hope this helps,

Kristian

dang
Path Finder

This works well. Thanks for your help.

0 Karma

sowings
Splunk Employee
Splunk Employee

To display just the times where the value is the min, you have to find that min first. I'd use eventstats; this writes a new field with the stat you described to each row, carried along with all of the other fields. You can then apply a filtering search to get only the records you want, and then select your fields:

index=main ComputerName=* sourcetype=WMI* AvailableMBytes
| eventstats min(AvailableMBytes) AS lowest by ComputerName
| where AvailableMBytes=lowest
| table _time, AvailableMBytes
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...