I am trying to figure out how much RAM an app on a Windows server is consuming for a given index.
The OS Technical Add-On does not have the top.sh command that unix offers. But thankfully from Splunk 6 onwards, we can get some app level stats because of _introspection.
Try the search:
index=_introspection host= component=PerProcess data.process= |timechart span=10m avg(data.pct_memory)
Example:
index=_introspection host=DEV* component=PerProcess data.process=splunkd |timechart span=10m avg(data.pct_memory)
Thank you for your time. I'll try this out and let you know.