Splunk Search

When alert triggers, add detail to inline table

tmarlette
Motivator

So I have a search that triggers based upon how much memory is being used on any of my linux machines. 

 

 

index=nix sourcetype=freemem  host=`<mySystemHosts>`
| eval pctUsed=(totMemory-cacheMemory)/totMemory * 100
| where pctUsed > 85
| table _time host pctUsed

 

 

 

That alert triggers fine, but I would like to add some details from my 'ps' data set about each individual job that is running on said host. 

so let's assume that the above alert triggers, and generates a table of 3 hosts.  I would like to add 'ps' contextual details to each of those devices within the alert itself.  

 

 

Labels (3)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...