topic Re: How to generate a search to find the average Splunk CPU and Memory usage for 24 hours? in Splunk Search

How to generate a search to find the average Splunk CPU and Memory usage for 24 hours?

nnimbe — Mon, 20 Mar 2017 06:15:29 GMT

Hi All,

I want to get the Splunk average CPU and memory usage for 24 hours using a search. Can you please help in building the search?

Re: How to generate a search to find the average Splunk CPU and Memory usage for 24 hours?

niketn — Mon, 20 Mar 2017 09:38:09 GMT

Have you looked at Monitoring Console or Distributed Management Console (Settings > Monitoring Console) in Splunk? It should give you access to CPU Memory and Disk usage stats with various aggregates.

Re: How to generate a search to find the average Splunk CPU and Memory usage for 24 hours?

nnimbe — Mon, 20 Mar 2017 11:14:15 GMT

@niketnilay, yes, but in that it is showing showing CPU and Memory usage with various components and with various services and as per my requirement i want single value(avg) in percentage for CPU and Memory usage for 24 hours , which covers all other sub processes and components

Re: How to generate a search to find the average Splunk CPU and Memory usage for 24 hours?

niketn — Mon, 20 Mar 2017 11:46:37 GMT

@nnimbe... Are you looking at Resource Usage : Machine?

`dmc_set_index_introspection` host=<YourSplunkServerName> sourcetype=splunk_resource_usage component=Hostwide
| `dmc_timechart` Avg(data.cpu_system_pct) AS "system"

Re: How to generate a search to find the average Splunk CPU and Memory usage for 24 hours?

nnimbe — Wed, 22 Mar 2017 12:37:11 GMT

@niketnilay , thanks but this query is not working in normal search and reporting app

and in distributed management console it is providing the output but the results are of for every 5 minute one value is coming

in our environment we have installed splunk on one server, my requirement is , i want average value of the CPU and Memory usage(single value) of that server in which splunk is installed for 24 hours,

for Example: if the total is 100%(CPU or Memory) how much utilization is happened on last 24 hours(avg), like 80% or
if physical memory is 30GB how much utilization is happened on last 24 hours(avg) , like 25 GB

like this the output is expected since we want single avg value because we want to include it in health check report

Re: How to generate a search to find the average Splunk CPU and Memory usage for 24 hours?

adonio — Wed, 22 Mar 2017 16:31:23 GMT

is it windows or linux?
you can just monitor the OS for cpu and mem performance. here is an example for windows checking memory index = perfmon source="Perfmon:Process" process_name=splunkd | timechart span=5m max(process_mem_used)

Re: How to generate a search to find the average Splunk CPU and Memory usage for 24 hours?

swapsplunk — Tue, 29 Sep 2020 13:21:28 GMT

Go under index=_introspection and sourcetype=splunk_resource_usage, you will find all necessary fields required to calculate CPU and memory (data.mem_used) and (data.pct_cpu) and then you can just plot chart command with an average value of those 2 fields for CPU and memory over last 24 hours

Re: How to generate a search to find the average Splunk CPU and Memory usage for 24 hours?

Supriya — Tue, 02 Feb 2021 17:33:05 GMT

@adonio @niketn

could you provide a stanza for [perfmon://Process] to receive process_mem_used