I have a Splunk forwarder installed on a Windows 2008 box. I have no issues getting back standard information, anything in perfmon, but am looking for a way to report physical memory usage % much like Processor Time%. Unfortunately perfmon does not offer any direct way of doing this without adding some counters and applying some math. This is easy enough but having issues pulling it in Splunk search.
So far the only two ways I can think of doing this is a .bat script to pull total mem - available MBytes from perfrom or taking commit limit - pagefile - Available MBytes, or run a ps1 script but this seems like an overly complicated approach, especially as I would like to chart this from a search.
In short is anyone charting physical memory usage as a % within a custom dashboard? And how did you accomplish this?(Custom Search with evals)? Ive looked into the Windows Infrastructure app but thats all perfmon data so same issue.
... View more