Splunk Search

Timechart RAM or CPU usage by Linux process

mxanareckless
Path Finder

1. There will be 2 separate charts: CPU usage by process, and RAM usage by process.

2. Sometimes more than one instance of a process is running. For example: there can be 2 splunkd processes, one using 170M and the other using 65M; in the chart I'd like this represented as 1 splunkd and the total of 235M between the 2 splunkd processes.

3. I'd like an overlay, an additional line on the timechart that shows the total RAM/CPU consumed on the server itself.

See below screenshots of the search I have constructed so far, and the printout of top on the server to demonstrate the presence of several processes by the same name, that I'd like to aggregate in the timechart's results.

spk1.PNGspk2.PNG

Labels (5)
Tags (5)
0 Karma

manderson7
Contributor

Back from the dead!

Big ask I realize, but did you get any further with this? We're stuck trying to get a better handle on mem utilization of processes, and this is a big step in the right direction.

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...