https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-check-memory-cpu-disk-usage-for-each/m-p/354648#M104954 <P>Hello,</P> <P>I would like to do a search against forwarders, once I found that forwarder is running, I need to check memory, cpu, disk usage. Is there a way I can do it?</P> Thu, 15 Jun 2017 16:10:21 GMT ananthan123 2017-06-15T16:10:21Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-check-memory-cpu-disk-usage-for-each/m-p/354648#M104954 <P>Hello,</P> <P>I would like to do a search against forwarders, once I found that forwarder is running, I need to check memory, cpu, disk usage. Is there a way I can do it?</P> Thu, 15 Jun 2017 16:10:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-check-memory-cpu-disk-usage-for-each/m-p/354648#M104954 ananthan123 2017-06-15T16:10:21Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-check-memory-cpu-disk-usage-for-each/m-p/354649#M104955 <P>This is the search I am using to find the uptime for forwarder.</P> <P>index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d | eval Host=coalesce(hostname, sourcehost) | eval age = (now() - _time ) | stats min(age) as age, max(_time) as LastTime by Host | convert ctime(LastTime) as "Last Active On" | eval Status= case(age &lt; 900,"Running",age &gt; 900,"DOWN")</P> <P>Once I found it is running, I need to go through CPU, Memory, Disk usage for each host</P> Tue, 29 Sep 2020 14:30:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-check-memory-cpu-disk-usage-for-each/m-p/354649#M104955 ananthan123 2020-09-29T14:30:33Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-check-memory-cpu-disk-usage-for-each/m-p/354650#M104956 <P>SSL does not include triggered actions. The easiest is to simply retrieve all information of interest then filter down hosts to meet your criteria, then extract memory, etc. for those hosts</P> Thu, 15 Jun 2017 18:36:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-check-memory-cpu-disk-usage-for-each/m-p/354650#M104956 yuanliu 2017-06-15T18:36:22Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-check-memory-cpu-disk-usage-for-each/m-p/354651#M104957 <P>hello there,<BR /> there are many simpler ways to check if a forwarder is running, here are couple examples from this portal:<BR /> <A href="https://answers.splunk.com/answers/132106/easiest-way-to-detect-if-splunk-forwarder-is-running-on-150-servers.html">https://answers.splunk.com/answers/132106/easiest-way-to-detect-if-splunk-forwarder-is-running-on-150-servers.html</A><BR /> <A href="https://answers.splunk.com/answers/11269/check-a-forwarder-is-working.html">https://answers.splunk.com/answers/11269/check-a-forwarder-is-working.html</A><BR /> <A href="https://answers.splunk.com/answers/798/how-do-i-tell-if-a-forwarder-is-down.html">https://answers.splunk.com/answers/798/how-do-i-tell-if-a-forwarder-is-down.html</A><BR /> Now for the second part of the question, do you collect CPU Memory and Disk usage form each host?<BR /> Are the hosts linux? windows? both?<BR /> there are many searches around that use case, here is an example for a (very) simple windows related search:</P> <PRE><CODE>index=perfmon source=Perfmon:CPU OR source=Perfmon:Memory OR source=Perfmon:LogicalDisk | stats latest(Value) by source counter host </CODE></PRE> <P>hope it hepls</P> Sun, 25 Jun 2017 03:12:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-check-memory-cpu-disk-usage-for-each/m-p/354651#M104957 adonio 2017-06-25T03:12:02Z