Splunk Search

multiple field conversions in a search eg kb to Mb

Conradj
Path Finder

Hi,

I have multiple fields returned in a search that I to plot as separate lines on a line graph. however, both fields are by default provided in bytes. I want to convert both in megabytes for the plot

Data might be for example...
time=12:00:00, memUsage=194433567, memPeak=1949456694

i can use | eval current=(memUsage/1024/1024)

But how do I convert the second? before going onto define the chart? (I am sure that its something very simple, but so far it has escaped me)

Cheers,

C.

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Something like:

<search_term> | eval current=(memUsage/1024/1024) | eval peak=memPeak/1048576 | timechart span=1h avg(current), max(peak)

?

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Something like:

<search_term> | eval current=(memUsage/1024/1024) | eval peak=memPeak/1048576 | timechart span=1h avg(current), max(peak)

?

View solution in original post

Conradj
Path Finder

(argh) Thank you 🙂

My error was in defining the chart to use two fields, not the conversion.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.