Splunk Search

Can you help me combine several applications and report on how much RAM those apps use by hostname?

jfattizzi
New Member

I have an application that uses several applications, and I need to report on the overall RAM Usage. I am using uberAgent on the Splunk Enterprise 6.68. Below is what I have so far, but I want to be able to report on it by host. For example:

hostname | Application1 | Application2 | Application3 | Total RAM Usage


host1 | 100MB | 125MB | 95MB | 320MB

host2 | 200MB | 225MB | 195MB | 620MB

| pivot uberAgent Process_ProcessDetail 
    sum(ProcCPUTimeS) as ProcCPUTimeS 
    sum(ProcCPUPercent) as ProcCPUPercent 
    sum(ProcWorkingSetMB) as ProcWorkingSetMB 
    values(ProcName) as ProcName 
    splitrow AppName as "App name" 
    host as host filter host in (*) 
    filter AppName in ("Application 1", "Application 2", "Application 3")
| stats 
    sum(ProcCPUTimeS) AS SumProcCPUTimeS 
    avg(ProcCPUPercent) AS FuncProcCPUPercent 
    avg(ProcWorkingSetMB) as FuncProcWorkingSetMB 
    values(ProcName) as "Process name(s)" by "App name" 
| eval "Total CPU time (s)"=round (SumProcCPUTimeS,1) 
| eval "Avg. CPU (%)"=round (FuncProcCPUPercent,1) 
| eval "Total IO (MB)"=round (SumProcIOMB,1) 
| eval "Avg. RAM (MB)"=round (FuncProcWorkingSetMB,0) 
| eval sortfield=lower ('App name') 
| eventstats sum("Avg. RAM (MB)") as total
| eval "Total Memory Usage" = round(total/1024/1024/1024*100,2)
| table "Total Memory Usage" host "App name" "Process name(s)" sortfield 
| sort limit=0 sortfield 
| fields - sortfield
Tags (1)
0 Karma

woodcock
Esteemed Legend

It looks like this is a question with an answer in it. I do not understand your need.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...