Splunk Search

search matters

HY
Explorer

Can someone provide me the commands to search for "top 10 CPU" and "top 10 memory" in Linux?

Tags (1)
0 Karma

joshd
Builder

Maybe there is some confusion in regards to what you're exactly looking for. But if you are looking for the memory and cpu usage by process, along with a list of the top processes consuming each then all you need to do is enable/install the Splunk for Unix and Linux app on your host. Then configure the top and ps inputs the application provides and finally after you launch the application it has the prebuilt searches to analyze CPU/memory usage by process, just choose what you would like to see from the proper drop down menu's.

If you're not looking to use this application at all then just grab the top and ps input commands, store them somewhere within your splunk installation (i.e. $SPLUNKHOME/etc/system/bin) go into the Splunk manager and enable the scripted inputs for each command, define a custom sourcetype and their own index if you wish. Remember to make the appropriate props.conf entries for each sourcetype similar, or the same, to those that the Splunk for Unix and Linux app have. Now look at the searches the Splunk for Unix and Linux application uses ($SPLUNKHOME/etc/apps/unix/default/macros.conf) and edit them accordingly for your environment (change the index, etc..).

0 Karma

HY
Explorer

Is the problem which I mentioned above arises form the configuration file?

0 Karma

HY
Explorer

I have looked through all the input commands for memory, cpu, disk, i/o, etc.. but from there I cannot come up with my own solution to search for the top 10 processes of the system listed above. I try modified the input values but to no avail....

0 Karma

joshd
Builder

Best thing to do is use the Splunk for Unix and Linux Application (http://splunk-base.splunk.com/apps/22314/splunk-for-unix-and-linux)...it already has the prebuilt inputs for memory, cpu, disk, i/o, etc.. monitoring. If you want your own solution, this would at least be a good place to start by looking at how they parse their input's and search upon them.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...