topic Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder? in Getting Data In

Is there an easy way to get resource usage per Splunk process for a universal forwarder?

a212830 — Wed, 29 Jun 2016 12:21:06 GMT

Hi,

Is there an easy way to get resource usage for a universal forwarder? I don't see anything in the distributed management console.

Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder?

woodcock — Wed, 29 Jun 2016 13:00:51 GMT

What do you mean? What would you like to see?

Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder?

a212830 — Wed, 29 Jun 2016 13:50:13 GMT

cpu and memory, mainly, per splunk process, if possible.

Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder?

woodcock — Wed, 29 Jun 2016 13:58:22 GMT

You need to deploy perfmon:

http://blogs.splunk.com/2013/10/28/new-features-for-perfmon-in-splunk-6/

Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder?

javiergn — Wed, 29 Jun 2016 14:00:44 GMT

Another approach (there might be more I'm sure).

If UNIX:

Deploy app that runs top or similar command every X seconds => index => search and use multikv to parse

If Windows:

Deploy app that runs powershell code (Get-Process, Get-Service, etc) every X seconds => index => search

Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder?

a212830 — Wed, 29 Jun 2016 14:07:39 GMT

Thanks. I take it that means it's not built into introspection?

Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder?

sloshburch — Wed, 29 Jun 2016 15:42:45 GMT

I thought most folks do this by using things like the Nix and Win TAs to get process resource consumption in the same way they would for any process running on the host. (A la ps.sh and its Windows equivalent)

Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder?

mwalker_splunk — Tue, 29 Sep 2020 10:04:33 GMT

You can enable platform instrumentation which will start populating the _introspection index (disabled by default on UF) by following these steps: http://docs.splunk.com/Documentation/Splunk/6.1.4/Troubleshooting/ConfigurePIF

sourcetype=splunk_resource_usage should give you some insights into what you're looking for.

Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder?

ddrillic — Wed, 29 Jun 2016 19:18:39 GMT

Most cheerful!

Re: Is there an easy way to get resource usage per Splunk process for a universal forwarder?

ecaepp — Wed, 29 Jun 2016 20:06:36 GMT

I would recommend using the "Splunk Add-on for Unix" app. It has many scripted inputs that can be turned on via the inputs.conf to collect such performance and usage data. (https://splunkbase.splunk.com/app/833/#/overview)

I would also like to note if you are going to use this on many UFs it is recommended that you use a deployment server to mange the app.