You can edit the *NIX script to add memCacheMB and memCachePct. Just adjust the following lines in $splunk_home/etc/apps/Splunk_TA_nix/bin/vmstat.sh. HEADER='memTotalMB memFreeMB memUsedMB memCacheMB memFreePct memUsedPct memCachePct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS' HEADERIZE="BEGIN {print \"$HEADER\"}" PRINTF='END {printf "%10d %10d %10d %10d %10.1f %10.1f %10.1f %10s %10.1f %10s %10s %10s %10s %10s %10s %10.2f %10.2f %10.2f %10.2f %10.2f\n", memTotalMB, memFreeMB, memUsedMB, memCacheMB, memFreePct, memUsedPct, memCachePct, pgPageOut, swapUsedP ct, pgSwapOut, cSwitches, interrupts, forks, processes, threads, loadAvg1mi, waitThreads, interrupts_PS, pgPageIn_PS, pgPageOut_PS}' DERIVE='END {memFreeMB+=memCacheMB; memUsedMB=memTotalMB-memFreeMB; memUsedPct=(100.0*memUsedMB)/memTotalMB; memFreePct=100.0-memUsedPct; memCachePct=(100.0*memCacheMB)/memTotalMB; swapUsedPct=swapUsed ? (100.0*swapUsed)/(swapUsed+swapFree) : 0; waitThreads=loadAvg1mi > cpuCount ? loadAvg1mi-cpuCount : 0}' and PARSE_1='/total memory$/ {memTotalMB=$1/1024} /free memory$/ {memFreeMB+=$1/1024} /buffer memory$/ {memFreeMB+=$1/1024} /swap cache$/ {memCacheMB=$1/1024}'   you can get outputs like this: # ./vmstat.sh memTotalMB memFreeMB memUsedMB memCacheMB memFreePct memUsedPct memCachePct pgPageOut swapUsedPct pgSwapOut cSwitches interrupts forks processes threads loadAvg1mi waitThreads interrupts_PS pgPageIn_PS pgPageOut_PS 2832 2165 667 1388 76.4 23.6 49.0 2331754 0.5 3064 6377829 6892068 160152 367 546 0.09 0.00 247.50 0.00 0.00 [root@bogon bin]# ... View more