Splunk Search

multiply a field value by number of distinguished hosts rather than fixed number

stucky101
Engager

Gurus

This should be simple and probably is but I can't get it to work. I have an index that captures some huge page stats from our oracle rac nodes. I'm trying to calculate total memory wasted per cluster because of over allocation of huge pages. Let's say I have 2 nodes in a cluster:

devdbc01n03
devdbc01n04

then the following works:

index=linux_huge_pages host=devdbc01n*.* | eval test_var = GB_Wasted * 2 | timechart avg(test_var)

GB_Wasted is a field that splunk extracts from the log and it contains the amount of GB wasted per rac node because it has not been allocated so times 2 shows the total amount of RAM wasted for this cluster (avg) in this case.
Problem is, the number of cluster members varies between 2 and 4 so the "2" here should really be dynamic. Based on the host=devdbc01n*.* wildcard it'll match the only 2 members of this cluster but I want splunk to determine this dynamically based on dc(host) instead.

I cannot get it to replace "2" with this dynamic value. I tried the following :

index=linux_huge_pages host=devdbc01n*.* | eval test_var = GB_Wasted * stats dc(host) | timechart avg(test_var)

that gives me an operator error
and this one:

index=linux_huge_pages host=devdbc01n*.* | stats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count | fields test_var

which doesn't throw an error but also doesn't show a number.
dc works by itself though.

index=linux_huge_pages host=devdbc01n*.* | stats dc(host)

this gives me the desired number of distinguished hosts but how do I assign a variable to it so I can do a calculation ?

thx

Tags (1)
0 Karma

stucky101
Engager

Thank you both. This does the trick.

0 Karma

stucky101
Engager

Thank you both. This does the trick.

0 Karma

jonuwz
Influencer

Dong stats dc(host) clobbers all the other fields, so you can't reference GB_Wasted later.

eventstats will add a new field to each line containing the number of distinct hosts so you can do your calculation :

index=linux_huge_pages host=devdbc01n*.* | eventstats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count | fields test_var

Edit - what Ayn said.

0 Karma

stucky101
Engager

works well - thank you !

0 Karma

Ayn
Legend

Use eventstats:

index=linux_huge_pages host=devdbc01n*.* | eventstats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count

stucky101
Engager

thank you for the quick reply - it works

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...