Splunk Search

How to generate a search to check memory, cpu, disk usage for each host?

ananthan123
Explorer

Hello,

I would like to do a search against forwarders, once I found that forwarder is running, I need to check memory, cpu, disk usage. Is there a way I can do it?

adonio
Ultra Champion

hello there,
there are many simpler ways to check if a forwarder is running, here are couple examples from this portal:
https://answers.splunk.com/answers/132106/easiest-way-to-detect-if-splunk-forwarder-is-running-on-15...
https://answers.splunk.com/answers/11269/check-a-forwarder-is-working.html
https://answers.splunk.com/answers/798/how-do-i-tell-if-a-forwarder-is-down.html
Now for the second part of the question, do you collect CPU Memory and Disk usage form each host?
Are the hosts linux? windows? both?
there are many searches around that use case, here is an example for a (very) simple windows related search:

index=perfmon  source=Perfmon:CPU OR source=Perfmon:Memory OR source=Perfmon:LogicalDisk
| stats latest(Value) by source counter host

hope it hepls

0 Karma

ananthan123
Explorer

This is the search I am using to find the uptime for forwarder.

index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d | eval Host=coalesce(hostname, sourcehost) | eval age = (now() - _time ) | stats min(age) as age, max(_time) as LastTime by Host | convert ctime(LastTime) as "Last Active On" | eval Status= case(age < 900,"Running",age > 900,"DOWN")

Once I found it is running, I need to go through CPU, Memory, Disk usage for each host

0 Karma

yuanliu
SplunkTrust
SplunkTrust

SSL does not include triggered actions. The easiest is to simply retrieve all information of interest then filter down hosts to meet your criteria, then extract memory, etc. for those hosts

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...