search matters

[HY]

Can someone provide me the commands to search for "top 10 CPU" and "top 10 memory" in Linux?

[joshd]

Maybe there is some confusion in regards to what you're exactly looking for. But if you are looking for the memory and cpu usage by process, along with a list of the top processes consuming each then all you need to do is enable/install the Splunk for Unix and Linux app on your host. Then configure the top and ps inputs the application provides and finally after you launch the application it has the prebuilt searches to analyze CPU/memory usage by process, just choose what you would like to see from the proper drop down menu's.

If you're not looking to use this application at all then just grab the top and ps input commands, store them somewhere within your splunk installation (i.e. $SPLUNKHOME/etc/system/bin) go into the Splunk manager and enable the scripted inputs for each command, define a custom sourcetype and their own index if you wish. Remember to make the appropriate props.conf entries for each sourcetype similar, or the same, to those that the Splunk for Unix and Linux app have. Now look at the searches the Splunk for Unix and Linux application uses ($SPLUNKHOME/etc/apps/unix/default/macros.conf) and edit them accordingly for your environment (change the index, etc..).

[HY]

Is the problem which I mentioned above arises form the configuration file?

[HY]

I have looked through all the input commands for memory, cpu, disk, i/o, etc.. but from there I cannot come up with my own solution to search for the top 10 processes of the system listed above. I try modified the input values but to no avail....

[joshd]

Best thing to do is use the Splunk for Unix and Linux Application (http://splunk-base.splunk.com/apps/22314/splunk-for-unix-and-linux)...it already has the prebuilt inputs for memory, cpu, disk, i/o, etc.. monitoring. If you want your own solution, this would at least be a good place to start by looking at how they parse their input's and search upon them.