All Apps and Add-ons

How to use different 'object' and 'counter' of perfmon in one search ?

henriq_c
Explorer

Hi,

I want to do a table using the eventtype 'perfmon_windows' but I want to see the Value of "% Free Space" and also the Value of "Committed Bytes" of my host. How can I see the value of both in a table ?

object="Memory" counter="Committed Bytes"
object="LogicalDisk" counter="% Free Space"

How to take the different values of each counter ? Because both have the name Value...

Thank you

0 Karma

davpx
Communicator

Quick and dirty example of the average of both over time.

sourcetype=Perfmon* (object="Memory" counter="Committed Bytes") OR (object="LogicalDisk" counter="% Free Space") 
|  timechart avg(Value) as Value by counter
0 Karma

henriq_c
Explorer

I want for exemple the value of % Free Space in a column, Committed Bytes in another, % Comitted in another, etc of each servers...
exemple :
server instance Free Space % RAM %
server1 C: 8 30
server2 😧 36 24
...

0 Karma

adonio
SplunkTrust
SplunkTrust

like this?

index = perfmon (object="Memory" counter="Committed Bytes") OR (object="LogicalDisk" counter="% Free Space")
| bin span=5m _time
| stats avg(Value) as avg_value by object counter host 
0 Karma

henriq_c
Explorer

I want for exemple the value of % Free Space in a column, Committed Bytes in another, % Comitted in another, of each serversetc...
exemple :
server instance Free Space % RAM %
server1 C: 8 30
server2 😧 36 24

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!