All Apps and Add-ons

summarizing unix app data

sonicZ
Contributor

I am looking to summarize some of the unix app searches such as "memory by process"
What's the best way to summarize and report on a group of hosts instead of a single host the prepopulated unix app search runs?

index=os sourcetype=ps
host=landdb01a.sso-bo.ilg1.vrsn.com |
multikv fields RSZ_KB, COMMAND |
sitimechart eval(median(RSZ_KB)/1024)
as ResidentMB by COMMAND

0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

I would recommend using the categories and groups feature built in to the app if you want to summarize. After you set up the category and groups, you'll use the category and group fields rather than the host field.

View solution in original post

araitz
Splunk Employee
Splunk Employee

I would recommend using the categories and groups feature built in to the app if you want to summarize. After you set up the category and groups, you'll use the category and group fields rather than the host field.

sonicZ
Contributor

Thanks, i'll have to start using the newest Unix app, behind the times a bit in 4.x app and did not see the categories/groups.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...