You can edit the *NIX script to get the desired result. Just adjust the following lines in $splunk_home/etc/apps/unix/bin/vmstat.sh. DERIVE='END {memUsedMB=memTotalMB-memFreeMB; to DERIVE='END {memUsedMB=memTotalMB-memFreeMB-memBuffMB-memCacheMB; and PARSE_1='/total memory$/ {memTotalMB=$1/1024} /free memory$/ {memFreeMB=$1/1024}' to PARSE_1='/total memory$/ {memTotalMB=$1/1024} /free memory$/ {memFreeMB=$1/1024} /buffer memory$/ {memBuffMB=$1/1024} /swap cache$/ {memCacheMB=$1/1024}' ... View more