uberAgent determines all the required data for charging based on usage. If you want to bill your customers depending on how much CPU or RAM their users' sessions consume you basically need the metrics CPU seconds per user and RAM GB hours per user. The latter can be explained as the number of gigabytes of RAM multiplied by the number of hours.
Example: RAM GB Hours per User
User A runs one session with an average RAM footprint of 2 GB for 3 hours. User B runs 2 sessions for 5 hours, one with an average RAM footprint of 1 GB and the other with an average RAM footprint of 2 GB. GB hours would be:
- User A: 2 GB * 3 hours = 6 GB hours
- User B: 1 GB * 5 hours + 2 GB * 5 hours = 15 GB hours
The following Splunk search will return the total CPU seconds and RAM GB hours per Active Directory user account. It can be run over any time range (= billing period). Please note that due to the nature of the calculation every started hour counts in full, i.e. the resolution is one hour.
| pivot uberAgent Session_SessionDetail_Users first(SessionUserLower) as User avg(SessionWorkingSetMB) as AvgHourSessionWorkingSetMB sum(SessionCPUTimeS) as SumHourSessionCPUTimeS splitrow _time period hour splitrow SessionGUID | eval AvgHourSessionWorkingSetGB=AvgHourSessionWorkingSetMB/1024 | stats count as SessionHours sum(AvgHourSessionWorkingSetGB) as GBHours sum(SumHourSessionCPUTimeS) as CPUSeconds avg(AvgHourSessionWorkingSetGB) as AvgSessionGB by User | eval GBHoursRounded=round(GBHours, 2) | eval CPUSecondsRounded=round(CPUSeconds, 2) | eval AvgSessionGBRounded=round(AvgSessionGB, 2) | fields User SessionHours GBHoursRounded CPUSecondsRounded AvgSessionGBRounded
Above search returns these fields per user:
- RAM GB hours
- CPU seconds
- Session hours (sessions * hours run per session)
- Average memory usage per session
How it Works
We are searching uberAgent's accelerated data model. That is why we use the pivot command.
The search consists of two main parts. First we determine the average RAM usage per session and hour. Then we summarize the session hours per user.
CPU usage is even easier to calculate because uberAgent already reports it as CPU seconds, so that we already have the length of time. We only need to summarize; we do that in two steps because the search needs to be constructed that way to determine RAM usage.