https://community.splunk.com/t5/Splunk-Search/Timechart-RAM-or-CPU-usage-by-Linux-process/m-p/558623#M158699 <P>1. There will be 2 separate charts: CPU usage by process, and RAM usage by process.</P><P>2. Sometimes more than one instance of a process is running. For example: there can be 2&nbsp;<STRONG>splunkd</STRONG> processes, one using 170M and the other using 65M; in the chart I'd like this represented as&nbsp;1 <STRONG>splunkd</STRONG> and the total of <STRONG>235M</STRONG> between the 2&nbsp;<STRONG>splunkd</STRONG> processes.</P><P>3. I'd like an overlay, an additional line on the timechart that shows the&nbsp;<STRONG>total RAM/CPU</STRONG> consumed on the server itself.</P><P>See below screenshots of the search I have constructed so far, and the printout of&nbsp;<STRONG>top</STRONG> on the server to demonstrate the presence of several processes by the same name, that I'd like to aggregate in the timechart's results.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="spk1.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14979iF9021870A094984E/image-size/large?v=v2&amp;px=999" role="button" title="spk1.PNG" alt="spk1.PNG" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="spk2.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14978iDB0B34F951E68F1D/image-size/large?v=v2&amp;px=999" role="button" title="spk2.PNG" alt="spk2.PNG" /></span></P> Wed, 07 Jul 2021 21:19:38 GMT mxanareckless 2021-07-07T21:19:38Z https://community.splunk.com/t5/Splunk-Search/Timechart-RAM-or-CPU-usage-by-Linux-process/m-p/558623#M158699 <P>1. There will be 2 separate charts: CPU usage by process, and RAM usage by process.</P><P>2. Sometimes more than one instance of a process is running. For example: there can be 2&nbsp;<STRONG>splunkd</STRONG> processes, one using 170M and the other using 65M; in the chart I'd like this represented as&nbsp;1 <STRONG>splunkd</STRONG> and the total of <STRONG>235M</STRONG> between the 2&nbsp;<STRONG>splunkd</STRONG> processes.</P><P>3. I'd like an overlay, an additional line on the timechart that shows the&nbsp;<STRONG>total RAM/CPU</STRONG> consumed on the server itself.</P><P>See below screenshots of the search I have constructed so far, and the printout of&nbsp;<STRONG>top</STRONG> on the server to demonstrate the presence of several processes by the same name, that I'd like to aggregate in the timechart's results.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="spk1.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14979iF9021870A094984E/image-size/large?v=v2&amp;px=999" role="button" title="spk1.PNG" alt="spk1.PNG" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="spk2.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14978iDB0B34F951E68F1D/image-size/large?v=v2&amp;px=999" role="button" title="spk2.PNG" alt="spk2.PNG" /></span></P> Wed, 07 Jul 2021 21:19:38 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-RAM-or-CPU-usage-by-Linux-process/m-p/558623#M158699 mxanareckless 2021-07-07T21:19:38Z https://community.splunk.com/t5/Splunk-Search/Timechart-RAM-or-CPU-usage-by-Linux-process/m-p/621392#M215980 <P>Back from the dead!</P><P>Big ask I realize, but did you get any further with this? We're stuck trying to get a better handle on mem utilization of processes, and this is a big step in the right direction.</P> Fri, 18 Nov 2022 15:00:22 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-RAM-or-CPU-usage-by-Linux-process/m-p/621392#M215980 manderson7 2022-11-18T15:00:22Z