Getting Data In

Windows Physical Memory Usage

nickkoe
Explorer

I have a Splunk forwarder installed on a Windows 2008 box. I have no issues getting back standard information, anything in perfmon, but am looking for a way to report physical memory usage % much like Processor Time%. Unfortunately perfmon does not offer any direct way of doing this without adding some counters and applying some math. This is easy enough but having issues pulling it in Splunk search.
So far the only two ways I can think of doing this is a .bat script to pull total mem - available MBytes from perfrom or taking commit limit - pagefile - Available MBytes, or run a ps1 script but this seems like an overly complicated approach, especially as I would like to chart this from a search.

In short is anyone charting physical memory usage as a % within a custom dashboard? And how did you accomplish this?(Custom Search with evals)? Ive looked into the Windows Infrastructure app but thats all perfmon data so same issue.

1 Solution

nickkoe
Explorer

One of the easiest ways I found was to have the powershell script do the math for memory then have it output it in a way that an indexer would see as a field. The ps1 script is below (borrowed script with some tweaks):


function Get-MemoryUsage ($ComputerName=$ENV:ComputerName) {

if (Test-Connection -ComputerName $ComputerName -Count 1 -Quiet) {
$ComputerSystem = Get-WmiObject -ComputerName $ComputerName -Class Win32_operatingsystem -Property CSName, TotalVisibleMemorySize, FreePhysicalMemory

$FreePhysicalMemory = ($ComputerSystem.FreePhysicalMemory) / (1mb)
$TotalVisibleMemorySize = ($ComputerSystem.TotalVisibleMemorySize) / (1mb)
$TotalVisibleMemorySizeR = “{0:N2}” -f $TotalVisibleMemorySize
$TotalFreeMemPerc = ((($TotalVisibleMemorySize-$FreePhysicalMemory)*100)/$TotalVisibleMemorySize)
$TotalFreeMemPercR = “{0:N2}” -f $TotalFreeMemPerc


“Ram = $TotalFreeMemPercR%”

} }

Get-MemoryUsage

This should allow you to chart only physical memory usage (no page or virtual commit values)

Basic search for charting in a dashboard:

sourcetype=sourcetype "Ram" host=$hn1$ | timechart span=1m avg(Ram) as "Ram"

View solution in original post

ninjafrog19
Engager

Here's a great blog post on achieving this: https://www.octamis.com/octamis-blog/windows-performance-monitoring-tips-with-splunk/

  • create a KVstore based lookup table to store our Windows configuration inventory data
  • schedule a report to update the lookup table on a regular basis (per day basis for example)
  • create an auto lookup configuration such that it is not necessary to perform the lookup command manually
0 Karma

nickkoe
Explorer

One of the easiest ways I found was to have the powershell script do the math for memory then have it output it in a way that an indexer would see as a field. The ps1 script is below (borrowed script with some tweaks):


function Get-MemoryUsage ($ComputerName=$ENV:ComputerName) {

if (Test-Connection -ComputerName $ComputerName -Count 1 -Quiet) {
$ComputerSystem = Get-WmiObject -ComputerName $ComputerName -Class Win32_operatingsystem -Property CSName, TotalVisibleMemorySize, FreePhysicalMemory

$FreePhysicalMemory = ($ComputerSystem.FreePhysicalMemory) / (1mb)
$TotalVisibleMemorySize = ($ComputerSystem.TotalVisibleMemorySize) / (1mb)
$TotalVisibleMemorySizeR = “{0:N2}” -f $TotalVisibleMemorySize
$TotalFreeMemPerc = ((($TotalVisibleMemorySize-$FreePhysicalMemory)*100)/$TotalVisibleMemorySize)
$TotalFreeMemPercR = “{0:N2}” -f $TotalFreeMemPerc


“Ram = $TotalFreeMemPercR%”

} }

Get-MemoryUsage

This should allow you to chart only physical memory usage (no page or virtual commit values)

Basic search for charting in a dashboard:

sourcetype=sourcetype "Ram" host=$hn1$ | timechart span=1m avg(Ram) as "Ram"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...