Splunk Cloud Platform

Capacity health check dashboard and query

ShamGowda
Loves-to-Learn Lots

Hi All,

I wanted to capture both Windows and Unix servers CPU, Memory and Disk usage.  below are sample event.

ShamGowda_0-1712035406415.png

ShamGowda_0-1712039371828.png

 

ShamGowda_1-1712039404997.png

 

Labels (1)
0 Karma

tej57
Contributor

Hey @ShamGowda ,

What is the concern here? Have you got the data already in the respective index? Also, have you explored Splunkbase already? There are quite lots of apps that helps visualizing the memory and CPU usage.

 

Thanks,
Tejas.

ShamGowda
Loves-to-Learn Lots

I am receiving the logs and required query to monitor top 10 highest use CPU, Memory, processor and Disk

0 Karma

deepakc
Builder

These are some basic examples once you have ingested the data, the same principles apply to Windows metrics

Analyse the data, work out the fields that contain the data and work on SPL, until it gives you the results

This example shows how you can monitor linux metrics - change the threshold (| where cpu_load_percent >=1)

index=linux sourcetype=cpu
| fields _time, host, cpu_load_percent, 
| eval date_time =strftime(_time, "%d/%m/%Y %H:%M:%S") 
| where cpu_load_percent >=1
| table date_time, host, cpu_load_percent
| dedup host

This example shows how you can memory percent % linux metrics - change the threshold (| where PercentMemory >=0)

index=linux sourcetype=ps 
| fields _time, host, PercentMemory 
| eval date_time =strftime(_time, "%d/%m/%Y %H:%M:%S") 
| where PercentMemory >=0
| table date_time, host, PercentMemory
| dedup host


Do similar for Disk/processor etc

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...