Alerting

How to set-up an alert when my memory usage goes above 80%?

manja054
Explorer

host=* sourcetype="Perfmon:Memory"

collection=Memory
object=Memory
counter="% Committed Bytes In Use"
Value=27.863303753428205

My stats looks like above and i want to be notified when my memory usage goes above 80%

Tags (2)

stephanefotso
Motivator

Hello! Try a search like this, and save it as an alert.

host=* sourcetype="Perfmon:Memory"  | stats count as mem  count(eval(counter="% Committed Bytes In Use")) as mem_used |eval percentage=round(mem_used/mem,3)*100 | where percentage > 80| fields  mem_used, mem, percentage

Thanks!

SGF

KSinghK
Loves-to-Learn Lots

% Committed Bytes In Use% is not the actual parameter to monitor memory.

 

sourcetype=perfmon* OR sourcetype=winhostmon FreePhysicalMemoryKB="*" i
| eval MemoryUsedPercent=round((TotalPhysicalMemoryKB - FreePhysicalMemoryKB)/TotalPhysicalMemoryKB * 100,2)
| eval MemoryUsedMB=(TotalPhysicalMemoryKB-FreePhysicalMemoryKB)/1024 | Stats count by host

0 Karma

KSinghK
Loves-to-Learn Lots

sourcetype=perfmon* OR sourcetype=winhostmon FreePhysicalMemoryKB="*" index=<your index> 
| eval MemoryUsedPercent=round((TotalPhysicalMemoryKB - FreePhysicalMemoryKB)/TotalPhysicalMemoryKB * 100,2)
| eval MemoryUsedMB=(TotalPhysicalMemoryKB-FreePhysicalMemoryKB)/1024 | stats count by host

 

updated the search just add your index here.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...