Monitoring Splunk

Query to get average memory usage in linux

AbdurRasheed
Engager

Hi,

I need help in finding the average memory usage of 100+ linux server. we dont have permon in splunk so i cant use that to get the memory data.

We have 1000s of server. For CPU , I somehow found below queries . But couldn't get one for memory usage.

Average CPU :

index=os host=hostname sourcetype=cpu | multikv | search CPU="all" | eval pctCPU=100-pctIdle | stats avg(pctCPU) by host

For max CPU :

index=os sourcetype=top host=hostname |stats max(pctCPU) AS maxCPU by _time, PID, COMMAND|sort -maxCPU

 

Labels (1)
Tags (3)
0 Karma
1 Solution

dave_null
Path Finder

Ultimately you need the memory usage information to appear in a log on the server so that Splunk can work with it. If you don't have a log with this information, then you will have to generate it yourself, either by installing a monitoring software or by running a scripted input.

One potential solution would be to run a scripted input on each linux server, which indexes the result of the "free -m" command. (perhaps with a grep to get a single line)

To do this, make an app or modify an app that is deployed to your linux servers. 

Here is the stanza for the inputs.conf of the app: (insert app name, index, interval, and sourcetype name below)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/getmem.sh]
disabled = false
index = ????
interval = 60
sourcetype = ????

Here is the code for the script: (save to $SPLUNK_HOME/etc/apps/<appname>/bin/getmem.sh 

#!/bin/bash
free -m | grep "Mem"

 

View solution in original post

0 Karma

dave_null
Path Finder

Ultimately you need the memory usage information to appear in a log on the server so that Splunk can work with it. If you don't have a log with this information, then you will have to generate it yourself, either by installing a monitoring software or by running a scripted input.

One potential solution would be to run a scripted input on each linux server, which indexes the result of the "free -m" command. (perhaps with a grep to get a single line)

To do this, make an app or modify an app that is deployed to your linux servers. 

Here is the stanza for the inputs.conf of the app: (insert app name, index, interval, and sourcetype name below)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/getmem.sh]
disabled = false
index = ????
interval = 60
sourcetype = ????

Here is the code for the script: (save to $SPLUNK_HOME/etc/apps/<appname>/bin/getmem.sh 

#!/bin/bash
free -m | grep "Mem"

 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...