Dashboards & Visualizations

How can I combine CPU Usage and Memory Usage statistics into one Visualization?

u2s1e0n2
New Member

I need help combining the CPU usage & memory Usage statistics to render as one visualization. The command below was gotten from my Distributed Management Console(DMC).

dmc_set_index_introspection search_group=* search_group="*" sourcetype=splunk_resource_usage component=Hostwide
| eval pct_mem_usage = 'data.mem_used' / 'data.mem' * 100 
| eval server = host 
| dmc_set_bin
| stats latest(pct_mem_usage) as dedup_pct_mem_usage by server _time 
| dmc_timechart Avg(dedup_pct_mem_usage) as pct_mem_usage

dmc_set_index_introspection search_group=* search_group="*" sourcetype=splunk_resource_usage component=Hostwide
| eval total_cpu_usage = ('data.cpu_system_pct' + 'data.cpu_user_pct')
| eval server = host
| dmc_set_bin
| stats latest(total_cpu_usage) as dedup_total_cpu_usage by server _time
| dmc_timechart Avg(dedup_total_cpu_usage) as cpu_usage
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this.. You can than format the chart so you can overlay the memory over the CPU

dmc_set_index_introspection search_group= search_group="" sourcetype=splunk_resource_usage component=Hostwide
| eval pct_mem_usage = 'data.mem_used' / 'data.mem' * 100 
| eval total_cpu_usage = ('data.cpu_system_pct' + 'data.cpu_user_pct')
| eval server = host 
| dmc_set_bin
| stats latest(pct_mem_usage) as dedup_pct_mem_usage latest(total_cpu_usage) as dedup_total_cpu_usage by server _time 
| dmc_timechart Avg(dedup_pct_mem_usage) as pct_mem_usage Avg(dedup_total_cpu_usage) as cpu_usage
0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...