This query will return results based on amount of available memory. I output it to a gauge, you’ll want to modify your gauge to show up red as it approaches zero. sourcetype=”Perfmon:Available Memory” | bucket _time span=1m | eval gigabytes=(((Value/1024)/1024)/1024) | eval GB=round(gigabytes, 2) | gauge GB Alternatively try this. Thanks to kharris! source=”Perfmon:Memory” counter=”Available […]
