All Apps and Add-ons

Example of how to measure memory swap operations?

sloshburch
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk to measure memory swap operations?

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

System administrators can identify systems that are running low on memory using the Splunk Add-on for Windows or the Splunk Add-on for Unix and Linux. IO operations can slow down if there isn't enough memory available, which can impact the user experience.

Load data

How to implement: This example use case depends on memory monitoring data from scripted inputs.

Install the Splunk Add-on for Windows or Splunk Add-on for Unix and Linux, and enable memory monitoring for your infrastructure. Follow the documentation to enable the basic data collection for memory utilization using the WinHostMon://OperatingSystem input of the Splunk Add-on for Microsoft Windows, and the script://./bin/vmstat.sh input of the Splunk Add-on for Unix and Linux. Find the Splunk Add-on for Windows and Splunk Add-on for Unix and Linux on Splunkbase.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Data check: Run the following search to verify you are searching for normalized performance data that is ready for this use case:

earliest=-1day index=* tag=performance
| head 10

Get insights

Identify systems that are running low on allocated physical memory or swapping to disk.

Run the following search.

index=* tag=oshost tag=performance tag=memory
| timechart avg(mem_page_ops) BY host

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

System administrators can identify systems that are running low on memory using the Splunk Add-on for Windows or the Splunk Add-on for Unix and Linux. IO operations can slow down if there isn't enough memory available, which can impact the user experience.

Load data

How to implement: This example use case depends on memory monitoring data from scripted inputs.

Install the Splunk Add-on for Windows or Splunk Add-on for Unix and Linux, and enable memory monitoring for your infrastructure. Follow the documentation to enable the basic data collection for memory utilization using the WinHostMon://OperatingSystem input of the Splunk Add-on for Microsoft Windows, and the script://./bin/vmstat.sh input of the Splunk Add-on for Unix and Linux. Find the Splunk Add-on for Windows and Splunk Add-on for Unix and Linux on Splunkbase.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Data check: Run the following search to verify you are searching for normalized performance data that is ready for this use case:

earliest=-1day index=* tag=performance
| head 10

Get insights

Identify systems that are running low on allocated physical memory or swapping to disk.

Run the following search.

index=* tag=oshost tag=performance tag=memory
| timechart avg(mem_page_ops) BY host

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...