Hi,
I have two searches Total Memory and Available memory and I want to subtract this two queries result, so that I can get Used Memory.
Total Memory
sourcetype=cf:valuemetric name=CapacityTotalMemory
| eval valueGTB=round(case(unit=="MiB", value/1024, unit=="KiB", value/(1024*1024), unit=="GiB", value),2)
| timechart span=5s avg(valueGTB) as valueGB by ip
| filldown | untable _time ip valueGTB
| timechart span=5s sum(valueGTB)
Available Memory
sourcetype=cf:valuemetric name=CapacityRemainingMemory
| eval valueGB=round(case(unit=="MiB", value/1024, unit=="KiB", value/(1024*1024), unit=="GiB", value),2)
| timechart span=5s avg(valueGB) as valueGB by ip
| filldown | untable _time ip valueGB
| timechart span=5s sum(valueGB)
I tried everything but could not figure it out.
... View more
