Splunk Search

"eval UsedMemory=(Avg_Memory/Total_Memory)" How do I know where the Avg_Memory and Total_Memory fields are coming from?

PreetiKa
Engager

I have a search which uses an eval expression for a calculation.

eval UsedMemory= (Avg_Memory/Total_Memory) 

I want to know where this Avg_Memory and Total_Memory fields are coming from or how are they are calculated.

Tags (2)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Check the events that have those fields. Those might be fields extracted directly from whats already available in your raw data. Can you give more information about what you looking at (e.g. sourcetype, etc)

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Check the events that have those fields. Those might be fields extracted directly from whats already available in your raw data. Can you give more information about what you looking at (e.g. sourcetype, etc)

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

PreetiKa
Engager
index=abc search_name="abc_MEMORY_SUMMARY" | 
lookup abc-environments host AS orig_host OUTPUT environment | 
search orig_host=SomeSpecificServer| timechart span=1min avg(eval((Avg_MemoryKb/Total_MemoryKb)*100)) as Memory by orig_host limit=0 | 
WHERE Memory > 90

This is my search; here I want to chart out the servers who have a memory consumption of over 90%, but the result is not satisfactory. I get almost every server with 50% memory consumption which is ideally not possible.

Also, I was wondering if I could create a lookup (without modifying my props.conf & transform.conf) and first list out the memory of all the hosts listed under my index? But I'm not sure if this is something achievable. Pardon me if this is something very simple. I am on my learning curve for SPLUNK. 🙂 Thank you for your time.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

About the original question, i still can't tell where those 2 fields are coming from 😕 are you using any TA (linux, windows)?
About the lookup, yes its possible to create. From the search you are already using a lookup the uses the host and outputs the "environment". To make it automatic, instead of using the command in your search, you can go to settings->lookups. You get 3 options after selection lookups.

  1. upload your csv
  2. create the lookup table
  3. create the automatic lookup

From the docs: lookups

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

PreetiKa
Engager

Thank you for your time. I got to figure this out after digging a little more with the help of a colleague. I appreciate your help 🙂

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...