Monitoring Splunk

How can I get the memory usage data of an indexer for the last 30 days per day?

New Member

Hi Team, I am checking for memory usage of an indexer by using:

| rest splunk_server=MONSPKPRDCI08 /services/server/status/resource-usage/splunk-processes
| eval sid = 'search_props.sid'
| `dmc_classify_processes`
| eval x="memory_usage"
| chart sum(mem_used) AS "Memory Usage" over x by process_class 

But it's giving me the average memory usage for last 30 days and I need data on individual days. Can you please suggest how can I get it?
Thank You

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

The documentation for the resource-usage call makes me think only the current usage is returned. Looking at the output seems to confirm that as there is no timestamp field in the data. I think the expectation is you will create a scheduled search that invokes resource-usage at intervals and saves the results in a summary index for later report generation.

There is another way. Try this search to get historical memory use (as a percentage).

index=_introspection component=PerProcess | rename data.process as process, data.pct_memory as mem_used | `dmc_classify_processes` | timechart max(mem_used) by process
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!