Windows Physical Memory Usage

[nickkoe]

I have a Splunk forwarder installed on a Windows 2008 box. I have no issues getting back standard information, anything in perfmon, but am looking for a way to report physical memory usage % much like Processor Time%. Unfortunately perfmon does not offer any direct way of doing this without adding some counters and applying some math. This is easy enough but having issues pulling it in Splunk search.
So far the only two ways I can think of doing this is a .bat script to pull total mem - available MBytes from perfrom or taking commit limit - pagefile - Available MBytes, or run a ps1 script but this seems like an overly complicated approach, especially as I would like to chart this from a search.

In short is anyone charting physical memory usage as a % within a custom dashboard? And how did you accomplish this?(Custom Search with evals)? Ive looked into the Windows Infrastructure app but thats all perfmon data so same issue.

[ninjafrog19]

Here's a great blog post on achieving this: https://www.octamis.com/octamis-blog/windows-performance-monitoring-tips-with-splunk/

• create a KVstore based lookup table to store our Windows configuration inventory data
• schedule a report to update the lookup table on a regular basis (per day basis for example)
• create an auto lookup configuration such that it is not necessary to perform the lookup command manually

[nickkoe · Accepted solution]

One of the easiest ways I found was to have the powershell script do the math for memory then have it output it in a way that an indexer would see as a field. The ps1 script is below (borrowed script with some tweaks):

---

function Get-MemoryUsage ($ComputerName=$ENV:ComputerName) {

if (Test-Connection -ComputerName $ComputerName -Count 1 -Quiet) {
$ComputerSystem = Get-WmiObject -ComputerName $ComputerName -Class Win32_operatingsystem -Property CSName, TotalVisibleMemorySize, FreePhysicalMemory

$FreePhysicalMemory = ($ComputerSystem.FreePhysicalMemory) / (1mb)
$TotalVisibleMemorySize = ($ComputerSystem.TotalVisibleMemorySize) / (1mb)
$TotalVisibleMemorySizeR = “{0:N2}” -f $TotalVisibleMemorySize
$TotalFreeMemPerc = ((($TotalVisibleMemorySize-$FreePhysicalMemory)*100)/$TotalVisibleMemorySize)
$TotalFreeMemPercR = “{0:N2}” -f $TotalFreeMemPerc


“Ram = $TotalFreeMemPercR%”

} }

Get-MemoryUsage

---

This should allow you to chart only physical memory usage (no page or virtual commit values)

Basic search for charting in a dashboard:

sourcetype=sourcetype "Ram" host=$hn1$ | timechart span=1m avg(Ram) as "Ram"