How is the Distributed Management Console Physical Memory Usage(%) value calculated?

[adamblock2]

We are currently running a distributed Splunk 6.2.3 infrastructure with multiple indexers.

According to the Distributed Management Console Resource Usage, each indexer shows "Physical Memory Usage(%)" as being > 96.5%.

I ran the command free -htlw on one of the indexers, and received the following results:

         total    used     free    shared    buffers    cache    available
Mem:     188G     2.1G     5.6G    24M       215M       180G     186G
Low:     188G     183G     5.6G
High:    0B       0B       0B
Swap:    4.0G     3.6M     4.0G
Total:   192G     2.1G     9.6G

Based on this information, I question the authenticity of that which is being reported by the Distributed Management Console. If someone could clarify exactly how these values differ, it would be greatly appreciated.

Thank you.

[hexx · Accepted solution]

Up until Splunk Enterprise 6.2.5 included, the platform instrumentation records that the DMC leverages for its views have reported system-wide physical memory usage by including OS buffers & cache.

This did not yield a value that was representative of the physical memory actually available on the system, which is why starting with Splunk Enterprise 6.2.6, platform instrumentation reports system-wide physical memory usage without including OS buffers & cache.

Therefore, our recommendation is to upgrade all instances monitored by the DMC to 6.2.6 or later.

Please see this Splunk Answer for full details.