Memory Usage

[SN1]

this is the search
| rest /services/server/status/partitions-space splunk_server=*
| eval free = if(isnotnull(available), available, free)
| eval usage_TB = round((capacity - free) /1024/1024, 2)
| eval free=round(free/1024/1024,2)
| eval capacity_TB = round(capacity /1024/1024, 2)
| eval pct_usage = round(usage / capacity * 100, 2)
| table splunk_server, usage_TB , capacity_TB , free

it gives memory usage of splunk servers , can this be implemented using _introspection index as well?

[livehybrid]

Hi @SN1 

Just to check - are you referring to disk usage rather than memory (RAM) usage?

If so, you can access this in the _introspection endpoint to get changes over time rather than just the current value using:

index="_introspection" sourcetype=splunk_disk_objects host=macdev 
| rename data.* as * 
| timechart latest(available) as available, latest(capacity) as capacity, latest(free) as free by mount_point

You can also use the _metrics index with mstats:

| mstats latest(spl.intr.disk_objects.Partitions.data.*) AS * WHERE index=_metrics sourcetype=splunk_intro_disk_objects component=Partitions by data.mount_point

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@SN1 

introspection index is intended to collect information about your systems running Splunk and give you more data to help diagnose Splunk performance issues. There are some details about what data is collected at About Splunk Enterprise platform instrumentation - Splunk Documentation

For example, If you want to search CPU and memory utilization per search execution with relevant information like which used executed and more.

index=_introspection host=* source=*/resource_usage.log* component=PerProcess data.process_type="search" 
| stats latest(data.pct_cpu) AS resource_usage_cpu latest(data.mem_used) AS resource_usage_mem by data.pid, _time, data.search_props.type,data.search_props.mode, data.search_props.role,data.search_props.user, data.search_props.app, data.search_props.sid

You may be able to find some useful information in the What does platform instrumentation log? - Splunk Documentation or the Introspection endpoint descriptions - Splunk Documentation