Splunk Search

How to edit my search to display a percentage in my table?

iatwal
Path Finder

What am I missing here? We have JVMs logging out to file every time there is a Garbage Collect, I'm trying to do a simple percentage of heap used calculation on the last Garbage Collection. I'm not getting the percentage in table format to work.

Search:

host="xxxx" heap_used=* total_heap_size=* | chart last(heap_used), last(total_heap_size) | eval percentage=(heap_used)/(total_heap_size)*100

heap_used and total_heap_size show up in the table, but no percentage...

0 Karma
1 Solution

somesoni2
Revered Legend

To be on safer side, do a numeric conversion of the heap_used and total_heap_size field

 host="xxxx" heap_used=* total_heap_size=* | chart latest(heap_used) as heap_used, latest(total_heap_size) as total_heap_size | eval percentage=tonumber(heap_used)*100/tonumber(total_heap_size)

View solution in original post

0 Karma

somesoni2
Revered Legend

To be on safer side, do a numeric conversion of the heap_used and total_heap_size field

 host="xxxx" heap_used=* total_heap_size=* | chart latest(heap_used) as heap_used, latest(total_heap_size) as total_heap_size | eval percentage=tonumber(heap_used)*100/tonumber(total_heap_size)
0 Karma

iatwal
Path Finder

ok this worked! the values were coming us alphanumeric instead of numerical... did this: convert num

0 Karma

sundareshr
Legend

Try this

host="xxxx" heap_used=* total_heap_size=* | head 1 | eval percentage=heap_used/total_heap_size*100 | table heap_used total_heap_size percentage

*If you want this by host, then try this*

host=* heap_used=* total_heap_size=* | stats last(heap_used) as heap_used last(total_heap_size) as total_heap_size by host | eval percentage=heap_used/total_heap_size*100 
0 Karma

skoelpin
SplunkTrust
SplunkTrust
host="xxxx" heap_used= total_heap_size= | chart last(heap_used), last(total_heap_size) | eval percentage=(heap_used)/(total_heap_size)*100 | table heap_used total_heap_size percentage 
0 Karma

iatwal
Path Finder

I tried this but I'm still not getting a value for percentage.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...