Splunk Search

search on aggregation

Explorer

These are two question that that i need to solve.

Memory loss by time *since boot* aggregated across entire population.

Memory loss by wall clock time aggregated across entire population. 

 

 

base query

(index=metrics OR index=hc_trials OR index=hc_prod) uptime>1800 (HCTELEM OR HCJUNK)
| fields + payload version deviceid
| eval payload=replace(payload, "\"\"", "\"")
| spath input=payload output=Mem1 path=Mem{1}

 

Please help me to solve this.

TIA

0 Karma