Can you help me combine several applications and report on how much RAM those apps use by hostname?

[jfattizzi]

I have an application that uses several applications, and I need to report on the overall RAM Usage. I am using uberAgent on the Splunk Enterprise 6.68. Below is what I have so far, but I want to be able to report on it by host. For example:

hostname | Application1 | Application2 | Application3 | Total RAM Usage

---

host1 | 100MB | 125MB | 95MB | 320MB

host2 | 200MB | 225MB | 195MB | 620MB

| pivot uberAgent Process_ProcessDetail 
    sum(ProcCPUTimeS) as ProcCPUTimeS 
    sum(ProcCPUPercent) as ProcCPUPercent 
    sum(ProcWorkingSetMB) as ProcWorkingSetMB 
    values(ProcName) as ProcName 
    splitrow AppName as "App name" 
    host as host filter host in (*) 
    filter AppName in ("Application 1", "Application 2", "Application 3")
| stats 
    sum(ProcCPUTimeS) AS SumProcCPUTimeS 
    avg(ProcCPUPercent) AS FuncProcCPUPercent 
    avg(ProcWorkingSetMB) as FuncProcWorkingSetMB 
    values(ProcName) as "Process name(s)" by "App name" 
| eval "Total CPU time (s)"=round (SumProcCPUTimeS,1) 
| eval "Avg. CPU (%)"=round (FuncProcCPUPercent,1) 
| eval "Total IO (MB)"=round (SumProcIOMB,1) 
| eval "Avg. RAM (MB)"=round (FuncProcWorkingSetMB,0) 
| eval sortfield=lower ('App name') 
| eventstats sum("Avg. RAM (MB)") as total
| eval "Total Memory Usage" = round(total/1024/1024/1024*100,2)
| table "Total Memory Usage" host "App name" "Process name(s)" sortfield 
| sort limit=0 sortfield 
| fields - sortfield

[woodcock]

It looks like this is a question with an answer in it. I do not understand your need.