Hi,
I'm using Splunk for Unix and Linux and when I go to the Memory by Host, it shows me the information however I do not have it split up by Host when I have 'all hosts' picked.
I'm expecting this to view just like CPU by Host
Any idea?
Thanks
The default graphs in that dashboard would lead to an 'extra' dimension as they have mulitple series on the same chart.
You could split out each of the functions:
## $SPLUNK_HOME/etc/apps/unix/local/macros.conf
## existing macro in the Dashboard
[Mem_Usage_for_Host(1)]
args = host
definition = index=os sourcetype=vmstat host=$host$ | multikv fields memFreePct, memUsedPct, swapUsedPct | timechart median(memFreePct) as Percent_Mem_Free, median(memUsedPct) as Percent_Mem_Used, median(swapUsedPct) as Percent_Swap
## new macros
[Mem_Free_for_Host(1)]
args = host
definition = index=os sourcetype=vmstat host=$host$ | multikv fields memFreePct, memUsedPct, swapUsedPct | timechart median(memFreePct) as Percent_Mem_Free by host
[Mem_Used_for_Host(1)]
args = host
definition = index=os sourcetype=vmstat host=$host$ | multikv fields memFreePct, memUsedPct, swapUsedPct | timechart median(memUsedPct) as Percent_Mem_Used by host
[Mem_Swap_for_Host(1)]
args = host
definition = index=os sourcetype=vmstat host=$host$ | multikv fields memFreePct, memUsedPct, swapUsedPct | timechart median(swapUsedPct) as Percent_Swap by host
And then switch out the view by placing the below into $SPLUNK_HOME/etc/apps/unix/local/data/ui/views/mem_by_host.xml
<form class="formsearch">
<label>Memory by Host</label>
<fieldset>
<input type="dropdown" token="host" searchWhenChanged="true">
<label>Host:</label>
<default>localhost</default>
<populatingSearch fieldForValue="host" fieldForLabel="host">| metadata type=hosts index=os</populatingSearch>
<choice value="*">all</choice>
</input>
<input type="time" searchWhenChanged="true"/>
</fieldset>
<row>
<html><center><h1>Memory by Host</h1></center></html>
</row>
<row>
<chart>
<title>Percent Memory Free by Host</title>
<searchTemplate>`Mem_Free_for_Host($host$)`</searchTemplate>
<option name="charting.chart">line</option>
<option name="charting.secondaryAxisTitle.text">% Mem Free</option>
</chart>
<chart>
<title>Percent Memory Used by Host</title>
<searchTemplate>`Mem_Used_for_Host($host$)`</searchTemplate>
<option name="charting.chart">line</option>
<option name="charting.secondaryAxisTitle.text">% Mem Used</option>
</chart>
<chart>
<title>Percent Memory Swap by Host</title>
<searchTemplate>`Mem_Swap_for_Host($host$)`</searchTemplate>
<option name="charting.chart">line</option>
<option name="charting.secondaryAxisTitle.text">% Mem Swap</option>
</chart>
</row>
<row>
<table>
<title>Physical Memory by Host</title>
<searchTemplate>`Memory_Hardware_by_Host($host$)`</searchTemplate>
</table>
</row>
</form>
The default graphs in that dashboard would lead to an 'extra' dimension as they have mulitple series on the same chart.
You could split out each of the functions:
## $SPLUNK_HOME/etc/apps/unix/local/macros.conf
## existing macro in the Dashboard
[Mem_Usage_for_Host(1)]
args = host
definition = index=os sourcetype=vmstat host=$host$ | multikv fields memFreePct, memUsedPct, swapUsedPct | timechart median(memFreePct) as Percent_Mem_Free, median(memUsedPct) as Percent_Mem_Used, median(swapUsedPct) as Percent_Swap
## new macros
[Mem_Free_for_Host(1)]
args = host
definition = index=os sourcetype=vmstat host=$host$ | multikv fields memFreePct, memUsedPct, swapUsedPct | timechart median(memFreePct) as Percent_Mem_Free by host
[Mem_Used_for_Host(1)]
args = host
definition = index=os sourcetype=vmstat host=$host$ | multikv fields memFreePct, memUsedPct, swapUsedPct | timechart median(memUsedPct) as Percent_Mem_Used by host
[Mem_Swap_for_Host(1)]
args = host
definition = index=os sourcetype=vmstat host=$host$ | multikv fields memFreePct, memUsedPct, swapUsedPct | timechart median(swapUsedPct) as Percent_Swap by host
And then switch out the view by placing the below into $SPLUNK_HOME/etc/apps/unix/local/data/ui/views/mem_by_host.xml
<form class="formsearch">
<label>Memory by Host</label>
<fieldset>
<input type="dropdown" token="host" searchWhenChanged="true">
<label>Host:</label>
<default>localhost</default>
<populatingSearch fieldForValue="host" fieldForLabel="host">| metadata type=hosts index=os</populatingSearch>
<choice value="*">all</choice>
</input>
<input type="time" searchWhenChanged="true"/>
</fieldset>
<row>
<html><center><h1>Memory by Host</h1></center></html>
</row>
<row>
<chart>
<title>Percent Memory Free by Host</title>
<searchTemplate>`Mem_Free_for_Host($host$)`</searchTemplate>
<option name="charting.chart">line</option>
<option name="charting.secondaryAxisTitle.text">% Mem Free</option>
</chart>
<chart>
<title>Percent Memory Used by Host</title>
<searchTemplate>`Mem_Used_for_Host($host$)`</searchTemplate>
<option name="charting.chart">line</option>
<option name="charting.secondaryAxisTitle.text">% Mem Used</option>
</chart>
<chart>
<title>Percent Memory Swap by Host</title>
<searchTemplate>`Mem_Swap_for_Host($host$)`</searchTemplate>
<option name="charting.chart">line</option>
<option name="charting.secondaryAxisTitle.text">% Mem Swap</option>
</chart>
</row>
<row>
<table>
<title>Physical Memory by Host</title>
<searchTemplate>`Memory_Hardware_by_Host($host$)`</searchTemplate>
</table>
</row>
</form>
Thanks! I've edited the answer
This works great, but one minor typo in the macros:
[Mem_Free_by_Host(1)]
Should be
[Mem_Free_for_Host(1)]