https://community.splunk.com/t5/Splunk-Search/CPU-amp-MEMORY-utilization/m-p/656771#M226842 <P>To get help about data analysis, you want to explain what data you have (preferably with text illustration), key characteristics of data, illustrate your desired output, and the logic between data and output.</P><P>Hope this helps.</P> Wed, 06 Sep 2023 06:29:53 GMT yuanliu 2023-09-06T06:29:53Z https://community.splunk.com/t5/Splunk-Search/CPU-amp-MEMORY-utilization/m-p/656765#M226837 <P>HI Team,</P><P>how to write search query for cpu &amp; memory utilization&nbsp;</P><P>&nbsp;</P><P>please help on this&nbsp;</P><P>&nbsp;</P><P>thanks</P> Wed, 06 Sep 2023 05:46:34 GMT https://community.splunk.com/t5/Splunk-Search/CPU-amp-MEMORY-utilization/m-p/656765#M226837 lucky 2023-09-06T05:46:34Z https://community.splunk.com/t5/Splunk-Search/CPU-amp-MEMORY-utilization/m-p/656771#M226842 <P>To get help about data analysis, you want to explain what data you have (preferably with text illustration), key characteristics of data, illustrate your desired output, and the logic between data and output.</P><P>Hope this helps.</P> Wed, 06 Sep 2023 06:29:53 GMT https://community.splunk.com/t5/Splunk-Search/CPU-amp-MEMORY-utilization/m-p/656771#M226842 yuanliu 2023-09-06T06:29:53Z https://community.splunk.com/t5/Splunk-Search/CPU-amp-MEMORY-utilization/m-p/656772#M226843 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/245717">@lucky</a>,</P><P>as also&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/33901">@yuanliu</a>&nbsp;asked, you should better desctibe your requirement:</P><UL><LI>did you already ingested data?</LI><LI>did you installed the Add-Ons to correctly parse data?</LI><LI>are you speaking of Windows or Linux systems,</LI></UL><P>Anyway the answer depends on these information.</P><P>Supponing that you are speaking of windows systems, that you already installed the requested Add-On (Splunk_TA_Windows) and that you already ingested the requested data (perfmon:CPU and perfmon:Memory), you could run something like this:</P><LI-CODE lang="markup">index=windows sourcetype=WinHostMon Type=Processor $host$ | eval host=upper(host) | dedup host | sort host | table Name NumberOfCores Architecture ClockSpeedMHz Manufacturer | rename name AS CPU Manufacturer AS "CPU Manufacturer"</LI-CODE><P>and</P><LI-CODE lang="markup">index=windows sourcetype=WinHostMon Type=OperatingSystem $host$ | eval host=upper(host) | dedup host | sort host | eval FreePhysicalMemoryGB=FreePhysicalMemoryKB/1024/1024, FreeVirtualMemoryGB=FreeVirtualMemoryKB/1024/1024, TotalPhysicalMemoryGB=TotalPhysicalMemoryKB/1024/1024, TotalVirtualMemoryGB=TotalVirtualMemoryKB/1024/1024, Virtual_mem_free_percent=FreeVirtualMemoryKB/TotalVirtualMemoryKB*100 | table FreePhysicalMemoryGB TotalPhysicalMemoryGB mem_free_percent FreeVirtualMemoryGB TotalVirtualMemoryGB Virtual_mem_free_percent | rename FreePhysicalMemoryGB AS "Free Physical Memory" TotalPhysicalMemoryGB AS "Total Physical Memory" mem_free_percent AS "Free Physical Memory%" FreeVirtualMemoryGB AS "Free Virtual Memory" TotalVirtualMemoryGB AS "Total Virtual Memory" Virtual_mem_free_percent AS "Free Virtual Memory%"</LI-CODE><P>to adapt to your requirements.</P><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Wed, 06 Sep 2023 06:40:22 GMT https://community.splunk.com/t5/Splunk-Search/CPU-amp-MEMORY-utilization/m-p/656772#M226843 gcusello 2023-09-06T06:40:22Z