I am collecting a PerfmonMK dataset that includes a memory value in bytes. I would like to display the value in KB. Normally, I would simply `eval` the value, but that's not returning anything. Is there something different about the way that multikv keynames are extracted that doesn't work with a subsequent eval? How can I display the value in KB?
Search:
sourcetype="PerfmonMK:Process_SSRS" | eval MemKB=(Working_Set_-_Private/1024)
_raw (5th field is of interest):
reportingservicesservice 0 1500 47 86646784 0.52650612403541508 0.59231938953984198
Inputs.conf
[perfmon://Process_SSRS]
interval = 60
object = Process
counters = % Processor Time; ID Process; Thread Count; Working Set - Private; IO Read Operations/sec; IO Write Operations/sec
instances = reportingservicesservice
index= perfmon
disabled = 0
useEnglishOnly = true
showZeroValue = true
mode = multikv
Splunk Enterprise 6.3.3 on both Indexer and Universal Forwarder.
↧