Dashboards & Visualizations

How can I combine CPU Usage and Memory Usage statistics into one Visualization?

u2s1e0n2
New Member

I need help combining the CPU usage & memory Usage statistics to render as one visualization. The command below was gotten from my Distributed Management Console(DMC).

dmc_set_index_introspection search_group=* search_group="*" sourcetype=splunk_resource_usage component=Hostwide
| eval pct_mem_usage = 'data.mem_used' / 'data.mem' * 100 
| eval server = host 
| dmc_set_bin
| stats latest(pct_mem_usage) as dedup_pct_mem_usage by server _time 
| dmc_timechart Avg(dedup_pct_mem_usage) as pct_mem_usage

dmc_set_index_introspection search_group=* search_group="*" sourcetype=splunk_resource_usage component=Hostwide
| eval total_cpu_usage = ('data.cpu_system_pct' + 'data.cpu_user_pct')
| eval server = host
| dmc_set_bin
| stats latest(total_cpu_usage) as dedup_total_cpu_usage by server _time
| dmc_timechart Avg(dedup_total_cpu_usage) as cpu_usage
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this.. You can than format the chart so you can overlay the memory over the CPU

dmc_set_index_introspection search_group= search_group="" sourcetype=splunk_resource_usage component=Hostwide
| eval pct_mem_usage = 'data.mem_used' / 'data.mem' * 100 
| eval total_cpu_usage = ('data.cpu_system_pct' + 'data.cpu_user_pct')
| eval server = host 
| dmc_set_bin
| stats latest(pct_mem_usage) as dedup_pct_mem_usage latest(total_cpu_usage) as dedup_total_cpu_usage by server _time 
| dmc_timechart Avg(dedup_pct_mem_usage) as pct_mem_usage Avg(dedup_total_cpu_usage) as cpu_usage
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...