https://community.splunk.com/t5/Splunk-Search/Documentation-for-introspection-Index/m-p/705706#M238905 <P><A href="https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTintrospect#server.2Fsysinfo" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTintrospect#server.2Fsysinfo</A></P><LI-CODE lang="markup">| rest /services/server/sysinfo | table splunk_server transparent_hugepage.effective_state</LI-CODE><P>The above will get you the THP status per server, usually best to run from the DMC in a multi server environment - most if not all devices should be reported there.&nbsp; Running from a SH or SHC may be limited to SH and IDX.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTintrospect#server.2Fstatus.2Fresource-usage.2Fhostwide" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTintrospect#server.2Fstatus.2Fresource-usage.2Fhostwide</A></P><LI-CODE lang="markup">| rest /services/server/status/resource-usage/hostwide | table splunk_server *cpu* *mem*</LI-CODE> Mon, 02 Dec 2024 16:00:57 GMT dural_yyz 2024-12-02T16:00:57Z https://community.splunk.com/t5/Splunk-Search/Documentation-for-introspection-Index/m-p/705686#M238891 <P>So I want to build a dashboard with _introspection index , some of the metrics I am looking for are THP (enabled/disabled), Ulimits, CPU, Mem, Disk usage, swap usage, clocks sync (realtime &amp; hardware) etc.<BR /><BR />I couldnt find any solid documentation for _introspection index as to under which source, component these variables will be stored also what all data is available in the index.&nbsp;<BR /><BR />Can someone please point me to a doumented list of all the data points in the index if any docs exists. Also any specific component/source I can find the KPIs I mentioned above.</P> Mon, 02 Dec 2024 14:15:38 GMT https://community.splunk.com/t5/Splunk-Search/Documentation-for-introspection-Index/m-p/705686#M238891 PotatoDataUser 2024-12-02T14:15:38Z https://community.splunk.com/t5/Splunk-Search/Documentation-for-introspection-Index/m-p/705702#M238903 <P>That is a Splunk internal index so any documentation (if it exists) would be internal to Splunk.&nbsp; You may be able to find some useful information in the <A href="https://docs.splunk.com/Documentation/Splunk/9.3.2/Troubleshooting/Whatdatagetslogged" target="_self">Troubleshooting Manual</A> or the <A href="https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTintrospect" target="_self">REST API Reference Manual</A>.</P> Mon, 02 Dec 2024 15:40:54 GMT https://community.splunk.com/t5/Splunk-Search/Documentation-for-introspection-Index/m-p/705702#M238903 richgalloway 2024-12-02T15:40:54Z https://community.splunk.com/t5/Splunk-Search/Documentation-for-introspection-Index/m-p/705706#M238905 <P><A href="https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTintrospect#server.2Fsysinfo" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTintrospect#server.2Fsysinfo</A></P><LI-CODE lang="markup">| rest /services/server/sysinfo | table splunk_server transparent_hugepage.effective_state</LI-CODE><P>The above will get you the THP status per server, usually best to run from the DMC in a multi server environment - most if not all devices should be reported there.&nbsp; Running from a SH or SHC may be limited to SH and IDX.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTintrospect#server.2Fstatus.2Fresource-usage.2Fhostwide" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.2/RESTREF/RESTintrospect#server.2Fstatus.2Fresource-usage.2Fhostwide</A></P><LI-CODE lang="markup">| rest /services/server/status/resource-usage/hostwide | table splunk_server *cpu* *mem*</LI-CODE> Mon, 02 Dec 2024 16:00:57 GMT https://community.splunk.com/t5/Splunk-Search/Documentation-for-introspection-Index/m-p/705706#M238905 dural_yyz 2024-12-02T16:00:57Z