After some tries I figured the way to collect this for multiple processes and sync the time in the process.
host=Hostname source="Perfmon:Memory" counter="Available MBytes" | eval FreeGB=Value/1024 | bin span=1m _time | dedup _time| fields _time, host, FreeGB | join host [search ComputerName="Hostname " sourcetype=WinHostMon Type=OperatingSystem | eval TotalGB=TotalPhysicalMemoryKB/1048576 |fields host, TotalGB] | eval Name="Memory Used", MemUsed=TotalGB-FreeGB | table _time, host, Name, TotalGB, MemUsed | append
[search host=Hostname AND sourcetype="Perfmon:Process" AND counter="Working Set - Private" AND (process_name="background*" OR
process_name="vizqlserver*" OR
process_name="dataserver*" OR
process_name="tdeserver*" OR
process_name="redis-server*") |
eval Name=case(like(instance, "background%"),"Backgrounder",
like(instance,"vizqlserver%"), "VizQL" ,
like(instance,"dataserver%"), "Data server",
like(instance,"tdeserver%"),"TD engine",
like(instance,"redis-server%"), "Cache server"),Value = Value/1073741824| bin span=1m _time | dedup _time, instance | stats sum(Value) as MemUsed by _time, Name, host | table _time, host, Name, MemUsed]
After this creating a pretty chart was easy.
... View more