topic How is the Distributed Management Console Physical Memory Usage(%) value calculated? in Monitoring Splunk

How is the Distributed Management Console Physical Memory Usage(%) value calculated?

adamblock2 — Fri, 08 Jan 2016 17:51:08 GMT

We are currently running a distributed Splunk 6.2.3 infrastructure with multiple indexers.

According to the Distributed Management Console Resource Usage, each indexer shows "Physical Memory Usage(%)" as being > 96.5%.

I ran the command free -htlw on one of the indexers, and received the following results:

         total    used     free    shared    buffers    cache    available
Mem:     188G     2.1G     5.6G    24M       215M       180G     186G
Low:     188G     183G     5.6G
High:    0B       0B       0B
Swap:    4.0G     3.6M     4.0G
Total:   192G     2.1G     9.6G

Based on this information, I question the authenticity of that which is being reported by the Distributed Management Console. If someone could clarify exactly how these values differ, it would be greatly appreciated.

Thank you.

Re: How is the Distributed Management Console Physical Memory Usage(%) value calculated?

hexx — Fri, 08 Jan 2016 18:42:21 GMT

Up until Splunk Enterprise 6.2.5 included, the platform instrumentation records that the DMC leverages for its views have reported system-wide physical memory usage by including OS buffers & cache.

This did not yield a value that was representative of the physical memory actually available on the system, which is why starting with Splunk Enterprise 6.2.6, platform instrumentation reports system-wide physical memory usage without including OS buffers & cache.

Therefore, our recommendation is to upgrade all instances monitored by the DMC to 6.2.6 or later.

Please see this Splunk Answer for full details.