Splunk Search

"eval UsedMemory=(Avg_Memory/Total_Memory)" How do I know where the Avg_Memory and Total_Memory fields are coming from?

PreetiKa
Engager

I have a search which uses an eval expression for a calculation.

eval UsedMemory= (Avg_Memory/Total_Memory) 

I want to know where this Avg_Memory and Total_Memory fields are coming from or how are they are calculated.

Tags (2)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Check the events that have those fields. Those might be fields extracted directly from whats already available in your raw data. Can you give more information about what you looking at (e.g. sourcetype, etc)

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Check the events that have those fields. Those might be fields extracted directly from whats already available in your raw data. Can you give more information about what you looking at (e.g. sourcetype, etc)

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

PreetiKa
Engager
index=abc search_name="abc_MEMORY_SUMMARY" | 
lookup abc-environments host AS orig_host OUTPUT environment | 
search orig_host=SomeSpecificServer| timechart span=1min avg(eval((Avg_MemoryKb/Total_MemoryKb)*100)) as Memory by orig_host limit=0 | 
WHERE Memory > 90

This is my search; here I want to chart out the servers who have a memory consumption of over 90%, but the result is not satisfactory. I get almost every server with 50% memory consumption which is ideally not possible.

Also, I was wondering if I could create a lookup (without modifying my props.conf & transform.conf) and first list out the memory of all the hosts listed under my index? But I'm not sure if this is something achievable. Pardon me if this is something very simple. I am on my learning curve for SPLUNK. 🙂 Thank you for your time.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

About the original question, i still can't tell where those 2 fields are coming from 😕 are you using any TA (linux, windows)?
About the lookup, yes its possible to create. From the search you are already using a lookup the uses the host and outputs the "environment". To make it automatic, instead of using the command in your search, you can go to settings->lookups. You get 3 options after selection lookups.

  1. upload your csv
  2. create the lookup table
  3. create the automatic lookup

From the docs: lookups

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

PreetiKa
Engager

Thank you for your time. I got to figure this out after digging a little more with the help of a colleague. I appreciate your help 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...