topic Re: Top 5 UNIX/Linux processes as per CPU in Splunk ITSI

Top 5 UNIX/Linux processes as per CPU

bsaujla131984 — Tue, 29 Sep 2020 21:23:32 GMT

I am trying to build a dashboard for listing of 5 top unix processes by CPU by using macro Top_5_CPU_Processes_by_Host(*) as listed in following link:-

https://docs.splunk.com/Documentation/UnixApp/5.2.4/User/Savedsearches

Can someone please guide me how to use this macro search?

Re: Top 5 UNIX/Linux processes as per CPU

renjith_nair — Tue, 29 Sep 2020 21:23:43 GMT

@bsaujla131984 ,

You can directly call this macro in your search/dashboard provided the dashboard has access to this macro - in other terms, share this macro with the app where you are creating the dashboard,

Try executing this macro in your search bar with " `Top_5_CPU_Processes_by_Host(*) ` " . Make sure that you have the backticks (`) while calling the macro

Alternatively, you can use the search which is used behind this macro

index=os sourcetype=top host=* | stats max(pctCPU) as maxCPU by host, COMMAND, _time | sort -maxCPU | dedup 5 host

Change the index if you are using other index than os

Re: Top 5 UNIX/Linux processes as per CPU

bsaujla131984 — Thu, 27 Sep 2018 03:42:51 GMT

Thanks Nair for your reply.

There is not sourcetype=top , so could not get any result.

Re: Top 5 UNIX/Linux processes as per CPU

bsaujla131984 — Thu, 27 Sep 2018 03:49:48 GMT

Also , where can we check commands running behind macros?

Thanks,

Re: Top 5 UNIX/Linux processes as per CPU

gjanders — Thu, 27 Sep 2018 23:01:07 GMT

Control Shift E will expand macros, as documented here , in newer Splunk versions

Re: Top 5 UNIX/Linux processes as per CPU

renjith_nair — Fri, 28 Sep 2018 12:37:18 GMT

@bsaujla131984 ,

Have you enabled the input for top in your inputs.conf ?

Re: Top 5 UNIX/Linux processes as per CPU

bsaujla131984 — Sun, 30 Sep 2018 01:00:15 GMT

Hello Ranjith,

Is there a way I can check commands running behind Macros?

Thanks,

Re: Top 5 UNIX/Linux processes as per CPU

dedwards93 — Sun, 30 Sep 2018 17:31:04 GMT

First make sure you deploy the Splunk Add-on for Unix and Linux on the servers you are trying to monitor (universal forwarders). By doing this, you will be receiving data from these servers as mentioned on the add-on documentation.

http://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About

This add-on will populate the index and sourcetypes needed so you can run search queries against it to build reports/dashboards, and populate data for the App.

Re: Top 5 UNIX/Linux processes as per CPU

renjith_nair — Mon, 01 Oct 2018 16:11:24 GMT

Yes, just open the macros.conf from the app's default/local directory and you should see this macro definition