multiply a field value by number of distinguished hosts rather than fixed number

[stucky101]

Gurus

This should be simple and probably is but I can't get it to work. I have an index that captures some huge page stats from our oracle rac nodes. I'm trying to calculate total memory wasted per cluster because of over allocation of huge pages. Let's say I have 2 nodes in a cluster:

devdbc01n03
devdbc01n04

then the following works:

index=linux_huge_pages host=devdbc01n*.* | eval test_var = GB_Wasted * 2 | timechart avg(test_var)

GB_Wasted is a field that splunk extracts from the log and it contains the amount of GB wasted per rac node because it has not been allocated so times 2 shows the total amount of RAM wasted for this cluster (avg) in this case.
Problem is, the number of cluster members varies between 2 and 4 so the "2" here should really be dynamic. Based on the host=devdbc01n*.* wildcard it'll match the only 2 members of this cluster but I want splunk to determine this dynamically based on dc(host) instead.

I cannot get it to replace "2" with this dynamic value. I tried the following :

index=linux_huge_pages host=devdbc01n*.* | eval test_var = GB_Wasted * stats dc(host) | timechart avg(test_var)

that gives me an operator error
and this one:

index=linux_huge_pages host=devdbc01n*.* | stats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count | fields test_var

which doesn't throw an error but also doesn't show a number.
dc works by itself though.

index=linux_huge_pages host=devdbc01n*.* | stats dc(host)

this gives me the desired number of distinguished hosts but how do I assign a variable to it so I can do a calculation ?

thx

[stucky101]

Thank you both. This does the trick.

[stucky101]

Thank you both. This does the trick.

[jonuwz]

Dong stats dc(host) clobbers all the other fields, so you can't reference GB_Wasted later.

eventstats will add a new field to each line containing the number of distinct hosts so you can do your calculation :

index=linux_huge_pages host=devdbc01n*.* | eventstats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count | fields test_var

Edit - what Ayn said.

[stucky101]

works well - thank you !

[Ayn]

Use eventstats:

index=linux_huge_pages host=devdbc01n*.* | eventstats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count

[stucky101]

thank you for the quick reply - it works