Splunk Search

multiply a field value by number of distinguished hosts rather than fixed number

stucky101
Engager

Gurus

This should be simple and probably is but I can't get it to work. I have an index that captures some huge page stats from our oracle rac nodes. I'm trying to calculate total memory wasted per cluster because of over allocation of huge pages. Let's say I have 2 nodes in a cluster:

devdbc01n03
devdbc01n04

then the following works:

index=linux_huge_pages host=devdbc01n*.* | eval test_var = GB_Wasted * 2 | timechart avg(test_var)

GB_Wasted is a field that splunk extracts from the log and it contains the amount of GB wasted per rac node because it has not been allocated so times 2 shows the total amount of RAM wasted for this cluster (avg) in this case.
Problem is, the number of cluster members varies between 2 and 4 so the "2" here should really be dynamic. Based on the host=devdbc01n*.* wildcard it'll match the only 2 members of this cluster but I want splunk to determine this dynamically based on dc(host) instead.

I cannot get it to replace "2" with this dynamic value. I tried the following :

index=linux_huge_pages host=devdbc01n*.* | eval test_var = GB_Wasted * stats dc(host) | timechart avg(test_var)

that gives me an operator error
and this one:

index=linux_huge_pages host=devdbc01n*.* | stats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count | fields test_var

which doesn't throw an error but also doesn't show a number.
dc works by itself though.

index=linux_huge_pages host=devdbc01n*.* | stats dc(host)

this gives me the desired number of distinguished hosts but how do I assign a variable to it so I can do a calculation ?

thx

Tags (1)
0 Karma

stucky101
Engager

Thank you both. This does the trick.

0 Karma

stucky101
Engager

Thank you both. This does the trick.

0 Karma

jonuwz
Influencer

Dong stats dc(host) clobbers all the other fields, so you can't reference GB_Wasted later.

eventstats will add a new field to each line containing the number of distinct hosts so you can do your calculation :

index=linux_huge_pages host=devdbc01n*.* | eventstats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count | fields test_var

Edit - what Ayn said.

0 Karma

stucky101
Engager

works well - thank you !

0 Karma

Ayn
Legend

Use eventstats:

index=linux_huge_pages host=devdbc01n*.* | eventstats dc(host) as dist_host_count | eval test_var = GB_Wasted * dist_host_count

stucky101
Engager

thank you for the quick reply - it works

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...