Splunk Search

How to generate a search to check memory, cpu, disk usage for each host?



I would like to do a search against forwarders, once I found that forwarder is running, I need to check memory, cpu, disk usage. Is there a way I can do it?

Ultra Champion

hello there,
there are many simpler ways to check if a forwarder is running, here are couple examples from this portal:
Now for the second part of the question, do you collect CPU Memory and Disk usage form each host?
Are the hosts linux? windows? both?
there are many searches around that use case, here is an example for a (very) simple windows related search:

index=perfmon  source=Perfmon:CPU OR source=Perfmon:Memory OR source=Perfmon:LogicalDisk
| stats latest(Value) by source counter host

hope it hepls

0 Karma


This is the search I am using to find the uptime for forwarder.

index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d | eval Host=coalesce(hostname, sourcehost) | eval age = (now() - _time ) | stats min(age) as age, max(_time) as LastTime by Host | convert ctime(LastTime) as "Last Active On" | eval Status= case(age < 900,"Running",age > 900,"DOWN")

Once I found it is running, I need to go through CPU, Memory, Disk usage for each host

0 Karma


SSL does not include triggered actions. The easiest is to simply retrieve all information of interest then filter down hosts to meet your criteria, then extract memory, etc. for those hosts

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...