Monitoring Splunk

Query to get average memory usage in linux

AbdurRasheed
Engager

Hi,

I need help in finding the average memory usage of 100+ linux server. we dont have permon in splunk so i cant use that to get the memory data.

We have 1000s of server. For CPU , I somehow found below queries . But couldn't get one for memory usage.

Average CPU :

index=os host=hostname sourcetype=cpu | multikv | search CPU="all" | eval pctCPU=100-pctIdle | stats avg(pctCPU) by host

For max CPU :

index=os sourcetype=top host=hostname |stats max(pctCPU) AS maxCPU by _time, PID, COMMAND|sort -maxCPU

 

Labels (1)
Tags (3)
0 Karma
1 Solution

dave_null
Path Finder

Ultimately you need the memory usage information to appear in a log on the server so that Splunk can work with it. If you don't have a log with this information, then you will have to generate it yourself, either by installing a monitoring software or by running a scripted input.

One potential solution would be to run a scripted input on each linux server, which indexes the result of the "free -m" command. (perhaps with a grep to get a single line)

To do this, make an app or modify an app that is deployed to your linux servers. 

Here is the stanza for the inputs.conf of the app: (insert app name, index, interval, and sourcetype name below)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/getmem.sh]
disabled = false
index = ????
interval = 60
sourcetype = ????

Here is the code for the script: (save to $SPLUNK_HOME/etc/apps/<appname>/bin/getmem.sh 

#!/bin/bash
free -m | grep "Mem"

 

View solution in original post

0 Karma

dave_null
Path Finder

Ultimately you need the memory usage information to appear in a log on the server so that Splunk can work with it. If you don't have a log with this information, then you will have to generate it yourself, either by installing a monitoring software or by running a scripted input.

One potential solution would be to run a scripted input on each linux server, which indexes the result of the "free -m" command. (perhaps with a grep to get a single line)

To do this, make an app or modify an app that is deployed to your linux servers. 

Here is the stanza for the inputs.conf of the app: (insert app name, index, interval, and sourcetype name below)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/getmem.sh]
disabled = false
index = ????
interval = 60
sourcetype = ????

Here is the code for the script: (save to $SPLUNK_HOME/etc/apps/<appname>/bin/getmem.sh 

#!/bin/bash
free -m | grep "Mem"

 

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...