I'm attempting to look at average free memory in GB on a number of servers (named server01, server02, etc) over time.
Doing this simple query I get the information I'm looking for, and the data is in gigabytes:
eventtype="windows_performance" Host="server*" object="Memory" counter="Available MBytes" | eval FreeGB=(Value/1024) | timechart span=30m avg(FreeGB) by Host
The problem I'm encountering is that I'd like to present the timecharted values as having only two decimal places, and I can't figure out how. Using "round" in the eval statement [for example eval FreeGB=round((Value/1024),2)] doesn't seem to work.
Any suggestions?
You could roll it all into one eval timechart function:
... | timechart span=30m eval(round(avg(Value)/1024,2)) by Host
That will compute the average, convert to GB, and round to tens of MB.
You could roll it all into one eval timechart function:
... | timechart span=30m eval(round(avg(Value)/1024,2)) by Host
That will compute the average, convert to GB, and round to tens of MB.
Just a heads up for anyone trying this, that eval naming is still required. Martin's example does it with the 'by' clause, or you can use the 'AS' to rename.
Won't work:
| timechart span=15m eval(round(avg(RMS_Watts_Tot),2))
^^ Error in 'timechart' command: The eval expression 'eval(round(avg(RMS_Watts_Tot),2))' must be renamed.
Works:
| timechart span=15m eval(round(avg(RMS_Watts_Tot),2)) AS watts
| timechart span=15m eval(round(avg(RMS_Watts_Tot),2)) by host
Thank you, Martin. That was the answer I was looking for.
"ROUND" is okay. Do you want to be a display what results? Value Is it a numeric type?Error Is the output to "search.log"?
round((tonumber(Value)/1024),2)