Splunk Search

How to edit my search to display a percentage in my table?

iatwal
Path Finder

What am I missing here? We have JVMs logging out to file every time there is a Garbage Collect, I'm trying to do a simple percentage of heap used calculation on the last Garbage Collection. I'm not getting the percentage in table format to work.

Search:

host="xxxx" heap_used=* total_heap_size=* | chart last(heap_used), last(total_heap_size) | eval percentage=(heap_used)/(total_heap_size)*100

heap_used and total_heap_size show up in the table, but no percentage...

0 Karma
1 Solution

somesoni2
Revered Legend

To be on safer side, do a numeric conversion of the heap_used and total_heap_size field

 host="xxxx" heap_used=* total_heap_size=* | chart latest(heap_used) as heap_used, latest(total_heap_size) as total_heap_size | eval percentage=tonumber(heap_used)*100/tonumber(total_heap_size)

View solution in original post

0 Karma

somesoni2
Revered Legend

To be on safer side, do a numeric conversion of the heap_used and total_heap_size field

 host="xxxx" heap_used=* total_heap_size=* | chart latest(heap_used) as heap_used, latest(total_heap_size) as total_heap_size | eval percentage=tonumber(heap_used)*100/tonumber(total_heap_size)
0 Karma

iatwal
Path Finder

ok this worked! the values were coming us alphanumeric instead of numerical... did this: convert num

0 Karma

sundareshr
Legend

Try this

host="xxxx" heap_used=* total_heap_size=* | head 1 | eval percentage=heap_used/total_heap_size*100 | table heap_used total_heap_size percentage

*If you want this by host, then try this*

host=* heap_used=* total_heap_size=* | stats last(heap_used) as heap_used last(total_heap_size) as total_heap_size by host | eval percentage=heap_used/total_heap_size*100 
0 Karma

skoelpin
SplunkTrust
SplunkTrust
host="xxxx" heap_used= total_heap_size= | chart last(heap_used), last(total_heap_size) | eval percentage=(heap_used)/(total_heap_size)*100 | table heap_used total_heap_size percentage 
0 Karma

iatwal
Path Finder

I tried this but I'm still not getting a value for percentage.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...