Monitoring Splunk

Query to get average memory usage in linux

AbdurRasheed
Engager

Hi,

I need help in finding the average memory usage of 100+ linux server. we dont have permon in splunk so i cant use that to get the memory data.

We have 1000s of server. For CPU , I somehow found below queries . But couldn't get one for memory usage.

Average CPU :

index=os host=hostname sourcetype=cpu | multikv | search CPU="all" | eval pctCPU=100-pctIdle | stats avg(pctCPU) by host

For max CPU :

index=os sourcetype=top host=hostname |stats max(pctCPU) AS maxCPU by _time, PID, COMMAND|sort -maxCPU

 

Labels (1)
Tags (3)
0 Karma
1 Solution

dave_null
Path Finder

Ultimately you need the memory usage information to appear in a log on the server so that Splunk can work with it. If you don't have a log with this information, then you will have to generate it yourself, either by installing a monitoring software or by running a scripted input.

One potential solution would be to run a scripted input on each linux server, which indexes the result of the "free -m" command. (perhaps with a grep to get a single line)

To do this, make an app or modify an app that is deployed to your linux servers. 

Here is the stanza for the inputs.conf of the app: (insert app name, index, interval, and sourcetype name below)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/getmem.sh]
disabled = false
index = ????
interval = 60
sourcetype = ????

Here is the code for the script: (save to $SPLUNK_HOME/etc/apps/<appname>/bin/getmem.sh 

#!/bin/bash
free -m | grep "Mem"

 

View solution in original post

0 Karma

dave_null
Path Finder

Ultimately you need the memory usage information to appear in a log on the server so that Splunk can work with it. If you don't have a log with this information, then you will have to generate it yourself, either by installing a monitoring software or by running a scripted input.

One potential solution would be to run a scripted input on each linux server, which indexes the result of the "free -m" command. (perhaps with a grep to get a single line)

To do this, make an app or modify an app that is deployed to your linux servers. 

Here is the stanza for the inputs.conf of the app: (insert app name, index, interval, and sourcetype name below)

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/getmem.sh]
disabled = false
index = ????
interval = 60
sourcetype = ????

Here is the code for the script: (save to $SPLUNK_HOME/etc/apps/<appname>/bin/getmem.sh 

#!/bin/bash
free -m | grep "Mem"

 

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...