topic Re: cpu and mem usage in Splunk Enterprise

cpu and mem usage

dall — Tue, 22 Sep 2020 05:15:27 GMT

Hi i am new to splunk dashboard

I have events like this from here, how i ll get cpu and memory usage?

can any one help on this??

<182>2020-09-18T08:01:18.787Z vmkernel: cpu56:6319637)Sched: vm 6319638: 6193: Adding world 'vmm0:bcollab-sie-lx', group 'host/user', cpu: shares=-1 min=-1 minLimit=-1 max=-1, mem: shares=-1 min=-1 minLimit=-1 max=-1

<182>2020-09-18T08:07:19.325Z vmkernel: cpu48:6320125)Sched: vm 6320126: 6193: Adding world 'vmm0:burp-collab-sie', group 'host/user', cpu: shares=-1 min=-1 minLimit=-1 max=-1, mem: shares=-1 min=-1 minLimit=-1 max=-1

<182>2020-09-18T07:26:07.290Z vmkernel: cpu34:6317318)Sched: vm 6317319: 6193: Adding world 'vmm0:burpcollab-sie', group 'host/user', cpu: shares=-1 min=-1 minLimit=-1 max=-1, mem: shares=-1 min=-1 minLimit=-1 max=-1

Re: cpu and mem usage

ITWhisperer — Tue, 22 Sep 2020 08:10:06 GMT

| rex "cpu\d+:(?<cpu>[^\)])\)Sched:\svm\s(?<vm>[^:]+)"

This assumes the cpu value you want is between the ":" and the ")" and the vm value you want is between the "vm " and the ":"

Re: cpu and mem usage

dall — Tue, 22 Sep 2020 10:13:06 GMT

sorry,this one is notgiving any result.

Re: cpu and mem usage

ITWhisperer — Tue, 22 Sep 2020 10:15:37 GMT

Which part of the message do you want? Can you copy it into a code section so it isn't formatted?