All Apps and Add-ons

How to use different 'object' and 'counter' of perfmon in one search ?

henriq_c
Explorer

Hi,

I want to do a table using the eventtype 'perfmon_windows' but I want to see the Value of "% Free Space" and also the Value of "Committed Bytes" of my host. How can I see the value of both in a table ?

object="Memory" counter="Committed Bytes"
object="LogicalDisk" counter="% Free Space"

How to take the different values of each counter ? Because both have the name Value...

Thank you

0 Karma

davpx
Communicator

Quick and dirty example of the average of both over time.

sourcetype=Perfmon* (object="Memory" counter="Committed Bytes") OR (object="LogicalDisk" counter="% Free Space") 
|  timechart avg(Value) as Value by counter
0 Karma

henriq_c
Explorer

I want for exemple the value of % Free Space in a column, Committed Bytes in another, % Comitted in another, etc of each servers...
exemple :
server instance Free Space % RAM %
server1 C: 8 30
server2 😧 36 24
...

0 Karma

adonio
Ultra Champion

like this?

index = perfmon (object="Memory" counter="Committed Bytes") OR (object="LogicalDisk" counter="% Free Space")
| bin span=5m _time
| stats avg(Value) as avg_value by object counter host 
0 Karma

henriq_c
Explorer

I want for exemple the value of % Free Space in a column, Committed Bytes in another, % Comitted in another, of each serversetc...
exemple :
server instance Free Space % RAM %
server1 C: 8 30
server2 😧 36 24

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...