How to generate a search to check memory, cpu, disk usage for each host?

[ananthan123]

Hello,

I would like to do a search against forwarders, once I found that forwarder is running, I need to check memory, cpu, disk usage. Is there a way I can do it?

[adonio]

hello there,
there are many simpler ways to check if a forwarder is running, here are couple examples from this portal:
https://answers.splunk.com/answers/132106/easiest-way-to-detect-if-splunk-forwarder-is-running-on-15...
https://answers.splunk.com/answers/11269/check-a-forwarder-is-working.html
https://answers.splunk.com/answers/798/how-do-i-tell-if-a-forwarder-is-down.html
Now for the second part of the question, do you collect CPU Memory and Disk usage form each host?
Are the hosts linux? windows? both?
there are many searches around that use case, here is an example for a (very) simple windows related search:

index=perfmon  source=Perfmon:CPU OR source=Perfmon:Memory OR source=Perfmon:LogicalDisk
| stats latest(Value) by source counter host

hope it hepls

[ananthan123]

This is the search I am using to find the uptime for forwarder.

index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d | eval Host=coalesce(hostname, sourcehost) | eval age = (now() - _time ) | stats min(age) as age, max(_time) as LastTime by Host | convert ctime(LastTime) as "Last Active On" | eval Status= case(age < 900,"Running",age > 900,"DOWN")

Once I found it is running, I need to go through CPU, Memory, Disk usage for each host

[yuanliu]

SSL does not include triggered actions. The easiest is to simply retrieve all information of interest then filter down hosts to meet your criteria, then extract memory, etc. for those hosts