All Apps and Add-ons

Can Splunk add a script to calculate swap stats for each PID in Splunk App for Unix and Linux or elsewhere?

New Member

I can get RSZ_KB and VSZ_KB stats from sourcetype=ps (and from top also but in different fields). These both values don't give us exact stats about how much swap space each process is using.

Here is the method I am using to calculate that on my Linux host:

grep Swap /proc/[1-9]*/smaps | grep -v '\W0 kB' > /tmp/swap1.out
sort -n -r -k2 /tmp/swap1.out > /tmp/swap.out

So now I can see in "swap.out" how much swap space each PID is using.

Can Splunk add a script to calculate swap for each PID in *NIX app or elsewhere?


0 Karma


You can add that script to your own instance of the unix app yourself, run extensive testing, and then feed that script back to Splunk for inclusion in a future version.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!