Alerting

How to set-up an alert when my memory usage goes above 80%?

manja054
Explorer

host=* sourcetype="Perfmon:Memory"

collection=Memory
object=Memory
counter="% Committed Bytes In Use"
Value=27.863303753428205

My stats looks like above and i want to be notified when my memory usage goes above 80%

Tags (2)

stephanefotso
Motivator

Hello! Try a search like this, and save it as an alert.

host=* sourcetype="Perfmon:Memory"  | stats count as mem  count(eval(counter="% Committed Bytes In Use")) as mem_used |eval percentage=round(mem_used/mem,3)*100 | where percentage > 80| fields  mem_used, mem, percentage

Thanks!

SGF

KSinghK
Loves-to-Learn Lots

% Committed Bytes In Use% is not the actual parameter to monitor memory.

 

sourcetype=perfmon* OR sourcetype=winhostmon FreePhysicalMemoryKB="*" i
| eval MemoryUsedPercent=round((TotalPhysicalMemoryKB - FreePhysicalMemoryKB)/TotalPhysicalMemoryKB * 100,2)
| eval MemoryUsedMB=(TotalPhysicalMemoryKB-FreePhysicalMemoryKB)/1024 | Stats count by host

0 Karma

KSinghK
Loves-to-Learn Lots

sourcetype=perfmon* OR sourcetype=winhostmon FreePhysicalMemoryKB="*" index=<your index> 
| eval MemoryUsedPercent=round((TotalPhysicalMemoryKB - FreePhysicalMemoryKB)/TotalPhysicalMemoryKB * 100,2)
| eval MemoryUsedMB=(TotalPhysicalMemoryKB-FreePhysicalMemoryKB)/1024 | stats count by host

 

updated the search just add your index here.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...