create a listing of min(foo) and _time

[dang]

I'm thinking what I'm trying to do is actually simple, I'm just not understanding the fundamental concept I need to use. I am looking at memory data for a collection of servers and starting my search like this:

index=main ComputerName=* sourcetype=WMI* AvailableMBytes

What I'm trying to do is create a list of information (and intentionally not using the words "chart" or "table", but I think that's where this is leading) where I present the values for "_time" and "min(AvailableBytes)" to show only the times each server have the lowest amount of available bytes of memory, with one row per server name.

Any suggestions?

[kristian_kolb · Accepted solution]

This can be achieved in several ways, one of them being

your search | sort AvailableMBytes | dedup host | table _time host AvailableMBytes

A subsearch could be another way of doing it

index=main sourcetype=WMI* [search index=main sourcetype=WMI* AvailableMBytes | stats min(AvailableMBytes) AS AvailableMBytes by host | fields + AvailableMBytes, host ] | table _time, host, AvailableMBytes

Hope this helps,

Kristian

[dang]

This works well. Thanks for your help.

[sowings]

To display just the times where the value is the min, you have to find that min first. I'd use eventstats; this writes a new field with the stat you described to each row, carried along with all of the other fields. You can then apply a filtering search to get only the records you want, and then select your fields:

index=main ComputerName=* sourcetype=WMI* AvailableMBytes
| eventstats min(AvailableMBytes) AS lowest by ComputerName
| where AvailableMBytes=lowest
| table _time, AvailableMBytes