How can I get a list of hosts with RAM changes?

[echwallah]

If some of my monitored hosts have their RAM increased without my knowledge and license consumption is affected, how can I get a list of these hosts and their changes?

[AntonioSousa · Accepted solution]

I would say the easiest way would be the API way, but then I just wondered the marvels that code in Data Explorer can give us:
(builtin:host.mem.total:splitBy("dt.entity.host"):sort(value(auto,descending)):limit(100)-builtin:host.mem.total:splitBy("dt.entity.host"):sort(value(auto,descending)):limit(100):timeshift(-90d)):sort(value(auto,descending))

Adjust the (-90d) to your needs, put a Table visualization, and you can even put it in a dashboard. BTW, I get some byte differences for some servers, not sure why...

[AntonioSousa]

Forgot to mention that if you get an error relating to resolution, you should adapt to the resolution of the (-90d) data consolidation. In this case, you should use 1 hour at least.

[echwallah]

Thanks @AntonioSousa I haave just run this query with timeshift -30d and am seeing hosts on one column and memory on the second. Could you please explain in detail what this query is attempting to do and the interpretation of the results with a possible screen grab of an example you have done. 

[AntonioSousa]

The second column is the difference in memory between now and 30 days ago. A positive value indicates that the server RAM has risen, and a negative value that the server RAM has been reduced, by the amount given.

Please notice that small values, in bytes, seem to arise from probably rounding errors...

[echwallah]

This is of great help. Thanks a million @AntonioSousa you are a Rock Star

[AntonioSousa]

@echwallah, BTW, If you do it as a graph, you can see when changes happened...

[Mizső]

Hi @AntonioSousa,

It a perfect solution (with my favourite data explorer transformation = timeshift).

Br, Mizső

[echwallah]

I am with you right there.Just realized how Quite powerful Data Explorer code builder is. The limit is just one's imagination