• Search
  • Dashboards
  • Browse
    • Sourcetype

      • _audit
      • _internal
      • access_combined
      • apache
      • audittrail
      • citrix:netscaler:syslog
      • Cron
      • crowdstrike
      • Dashboards
      • datamodels
      • DBConnect
      • Enterprise Security
      • eval
      • F5
      • Fun Stuff & Helpful Hints
      • Hack
      • Hygiene
      • IIS
      • Juniper
      • Linux Performance
      • linux_secure
      • Malware
      • Monitoring
      • Networking
      • opensense
      • opsec
      • osx_secure
      • Perfmon:Available Memory
      • Perfmon:CPU Load
      • Perfmon:Free Disk Space
      • Perfmon:Network Interface
      • postfix_syslog
      • Qualys
      • REST
      • RFQ – Request For Query
      • splunkd
      • Tenable
      • Uncategorized
      • Unix:Uptime
      • WinEventLog:Application
      • WinEventLog:Security
      • WinEventLog:System
      • WinRegistry
      • WMI:Uptime
    • Tags

      6.1.2 admin apache audit audittrail authentication Cisco Diagnostics failed logon Firewall IIS index indexes internal license License usage Linux linux audit Login Logon malware Network Perfmon Performance qualys REST Security sourcetype splunk splunkd splunk on splunk Tenable Tenable Security Center troubleshoot troubleshooting tstats Universal Forwarder users Vulnerabilities Web Traffic Windows Windows Audit Windows Security _audit _internal
  • Post New Query
  • Our Blog
  • Splunk Jobs
  • Search
  • Dashboards
  • Browse
    • Sourcetype

      • _audit
      • _internal
      • access_combined
      • apache
      • audittrail
      • citrix:netscaler:syslog
      • Cron
      • crowdstrike
      • Dashboards
      • datamodels
      • DBConnect
      • Enterprise Security
      • eval
      • F5
      • Fun Stuff & Helpful Hints
      • Hack
      • Hygiene
      • IIS
      • Juniper
      • Linux Performance
      • linux_secure
      • Malware
      • Monitoring
      • Networking
      • opensense
      • opsec
      • osx_secure
      • Perfmon:Available Memory
      • Perfmon:CPU Load
      • Perfmon:Free Disk Space
      • Perfmon:Network Interface
      • postfix_syslog
      • Qualys
      • REST
      • RFQ – Request For Query
      • splunkd
      • Tenable
      • Uncategorized
      • Unix:Uptime
      • WinEventLog:Application
      • WinEventLog:Security
      • WinEventLog:System
      • WinRegistry
      • WMI:Uptime
    • Tags

      6.1.2 admin apache audit audittrail authentication Cisco Diagnostics failed logon Firewall IIS index indexes internal license License usage Linux linux audit Login Logon malware Network Perfmon Performance qualys REST Security sourcetype splunk splunkd splunk on splunk Tenable Tenable Security Center troubleshoot troubleshooting tstats Universal Forwarder users Vulnerabilities Web Traffic Windows Windows Audit Windows Security _audit _internal
  • Post New Query
  • Our Blog
  • Splunk Jobs

Members

Profile picture of kharris

kharris

@kharris Active 8 years, 1 month ago
@hagjos43 How can you convert the available memory into a percentage, like we see it in task manager, 50% used 50% free ? View
  • Activity
  • Profile
  • Posts
  • Personal
  • Mentions
  • Favorites
  • Profile picture of kharris
    8 years, 4 months ago

    kharris posted a new activity comment

    In reply to: kharris posted an update @hagjos43 How can you convert the available memory into a percentage, like we see it in task manager, 50% used 50% free ? View

    it is giving me the results in Gbs , below is an example of the results. If splunk would give me the max memory of each server, I could use the results below, but since it does not, I rather see the results in percentages if possible.

    Host Trend Average Peak Current Last Updated
    myHost TrendGraph 0.31 0.32 0.30…[Read more]

  • Profile picture of kharris
    8 years, 6 months ago

    kharris posted a new activity comment

    In reply to: kharris posted an update @hagjos43 How can you convert the available memory into a percentage, like we see it in task manager, 50% used 50% free ? View

    this is what I currently have

    index=platform sourcetype=”Perfmon:Memory” counter=”Available Mbytes”| bucket _time span=1m | chart sparkline(avg(Value)) as Trend avg(Value) as Average, max(Value) as Peak, latest(Value) as Current, latest(_time) as “Last Updated” by Host | convert ctime(“Last Updated”) | sort – Average) |eval…[Read more]

    • Profile picture of SplunkNinja
      SplunkNinja replied 8 years, 6 months ago

      Are you getting the output without the percent? Essentially the number but juts looking for the % sign? From the looks of the query that is what I’m seeing (without running it lol)

      • Profile picture of kharris
        kharris replied 8 years, 4 months ago

        it is giving me the results in Gbs , below is an example of the results. If splunk would give me the max memory of each server, I could use the results below, but since it does not, I rather see the results in percentages if possible.

        Host Trend Average Peak Current Last Updated
        myHost TrendGraph 0.31 0.32 0.30…[Read more]

  • Profile picture of kharris
    8 years, 6 months ago

    kharris posted an update

    @hagjos43 How can you convert the available memory into a percentage, like we see it in task manager, 50% used 50% free ?

    • Profile picture of kharris
      kharris replied 8 years, 6 months ago

      this is what I currently have

      index=platform sourcetype=”Perfmon:Memory” counter=”Available Mbytes”| bucket _time span=1m | chart sparkline(avg(Value)) as Trend avg(Value) as Average, max(Value) as Peak, latest(Value) as Current, latest(_time) as “Last Updated” by Host | convert ctime(“Last Updated”) | sort – Average) |eval…[Read more]

      • Profile picture of SplunkNinja
        SplunkNinja replied 8 years, 6 months ago

        Are you getting the output without the percent? Essentially the number but juts looking for the % sign? From the looks of the query that is what I’m seeing (without running it lol)

        • Profile picture of kharris
          kharris replied 8 years, 4 months ago

          it is giving me the results in Gbs , below is an example of the results. If splunk would give me the max memory of each server, I could use the results below, but since it does not, I rather see the results in percentages if possible.

          Host Trend Average Peak Current Last Updated
          myHost TrendGraph 0.31 0.32 0.30…[Read more]

  • Profile picture of kharris
    8 years, 6 months ago

    kharris wrote a new post

    host=”*”  sourcetype=iis (insertIISurl) | eval time_taken = time_taken/1000  | stats  max(time_taken) AS “Highest Response Time”
    host=”*”  sourcetype=iis (insertIISurl) | eval time_taken = time_taken/1000  | stat […]

  • Profile picture of kharris
    9 years, 1 month ago

    kharris commented on the post, Available Memory in a Windows box

    In reply to: SplunkNinja wrote a new post This query will return results based on amount of available memory. I output it to a gauge, you’ll want to modify your gauge to show up red as it approaches […] View

    You are the man, I have tried this for a few months and could not get it to give me the correct available memory. For some reason my memory counter is already in MB, so i changed part of it to work for me, thank you again :) !

    source=”Perfmon:Memory” counter=”Available Mbytes” | bucket _time span=1m | eval gigabytes=(Value/1024) | eval…[Read more]

  • Profile picture of kharris
    9 years, 1 month ago

    kharris posted an update

    @hagjos43 Have you found out a way to monitor physical memory with splunk, I have all of the memory counters but none show total memory and memory used ?

  • Profile picture of kharris
    9 years, 2 months ago

    kharris commented on the post, Simple GeoIP Information for Web Traffic

    In reply to: ItsJohnLocke wrote a new post This simple query will show if IIS traffic came to a given site from three geographical possibilities: “United States” “International” or “Unknown” sources. This relies entirely on […] View

    all of mine show as unknown location, can you help me figure out what I am doing wrong ? I have around 5k iis web servers.

  • Profile picture of kharris
    9 years, 10 months ago

    kharris wrote a new post

    This will hit all of the host and pull back the eventlogs and group them by Message.

    You can change the source to what ever windows eventlogs you […]

  • Profile picture of kharris
    9 years, 11 months ago

    kharris changed their profile picture

  • Profile picture of kharris
    9 years, 11 months ago

    kharris became a registered member

  • Home
  • Log In
  • Register
  • About GoSplunk
  • GoSplunk FAQs
  • Contact the GoSplunk Team
  • Splunk Website
  • Splunk Documentation
  • Splunk Answers

GoSplunk is not affiliated with Splunk Inc. in any way.

© 2019 GoSplunk
  • Privacy Policy
  • Terms and Conditions
  • Forgot Password?
sponsored