Archive

Monitor CPU, Disk and Ram.

fsrodriguez
New Member

How can I create a radial gauge that would display CPU? and what would be the command for Disk and RAM?

Thank you in Advance.

Tags (2)
0 Karma
1 Solution

sbbadri
Motivator

@fsrodriguez

please download https://splunkbase.splunk.com/app/833/#/details.

1) Deploy this Splunk_TA_nix to the servers were you have to monitor
2) Enable CPU,RAM and DISK script
3) restart the server.
4) you will get the data under os index.

or

Try with NMON . It will pull you all necessary metrics from linux hosts ( except HPUX os)
https://splunkbase.splunk.com/app/3248/ - TA-nmon - need to be install/deployed on UF / hosts
https://splunkbase.splunk.com/app/1753/ - NMON APP - need to be installed or deployed on SH (But look for data model settings)

I hope this helps you.

View solution in original post

0 Karma

sbbadri
Motivator

@fsrodriguez

please download https://splunkbase.splunk.com/app/833/#/details.

1) Deploy this Splunk_TA_nix to the servers were you have to monitor
2) Enable CPU,RAM and DISK script
3) restart the server.
4) you will get the data under os index.

or

Try with NMON . It will pull you all necessary metrics from linux hosts ( except HPUX os)
https://splunkbase.splunk.com/app/3248/ - TA-nmon - need to be install/deployed on UF / hosts
https://splunkbase.splunk.com/app/1753/ - NMON APP - need to be installed or deployed on SH (But look for data model settings)

I hope this helps you.

View solution in original post

0 Karma

fsrodriguez
New Member

I already had Splunk_TA_nix Installed. Thank you so much!

This is all I had to do:
host="app-1" source="cpu" | gauge cpu_load_percent 25 50 65 75 85 95 100

0 Karma

niketnilay
Legend

@ fsrodriguez, can you try the following run anywhere search?

| makeresults
| head 1
| eval yourCPUFieldName=14.2
| gauge yourCPUFieldName 0 10 30 50

If the same works you need to replace | makeresults with your base search to get CPU Value.
| head 1 gets only the latest result for CPU
If you want the CPU for multiple hosts you can leverage the Trellis Layout, provided your are on Splunk Enterprise version 6.6 or later.

PS: I have used run anwhere dashboard to use Splunk's _introspection index to get the CPU percent. Also I have used date_hour in the query and also for Trellis split by <option name="trellis.splitBy">date_hour</option>. You would need to replace your query and also convert from date_hour to host

<dashboard>
  <label>Radial Gauge for CPU</label>
  <row>
    <panel>
      <title>CPU by date_hour</title>
      <chart>
        <search>
          <query>index="_introspection" sourcetype="splunk_resource_usage" data.pct_cpu=*
| stats latest(data.pct_cpu) as CPU by date_hour</query>
          <earliest>-4h@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.rangeValues">[0,60,85,100]</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">["0x84E900","0xFFE800","0xBF3030"]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">none</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">date_hour</option>
      </chart>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
0 Karma

fsrodriguez
New Member

Yes I've seen that documentation, thank you. I know how to create it but I don't know how to pull the data values I need. CPU RAM and MEM.

0 Karma

nickhills
Ultra Champion

The links above detail how to chart the data if you have it, but Is your question:
How do I get CPU/Disk/Ram metrics into Splunk?

If so, can you detail which operating systems you are interested in monitoring?

If my comment helps, please give it a thumbs up!
0 Karma

fsrodriguez
New Member

I'm trying to pull it from an Amazon Linux AMI.

0 Karma