Getting Data In

Splunk query to fetch Heavy forwarder's Hardware specifications

swamysanjanaput
Explorer

Hi Splunkers,

I am still a beginner, trying to write a query to fetch splunk heavy forwarder's cpu, memory usage and other hardware related stuff. With the below query i am not able to fetch the correct values for Heavy forwarders(see below results). So, could anyone please help me to resolve this issue.

Query: internal host=spi source="/opt/splunk/var/log/splunk/metrics.log" fwdType=full | dedup hostname | table hostname | join type=left [search index = * sourcetype=nix:hardware host=* | rex mode=sed "s/\s\s+/=/g" | extract kvdelim="=" pairdelim="\n" ] |table hostname,CPU_TYPE,CPU_COUNT,MEMORY_REAL

Results: Same values being replicated for all Hfs which is incorrect

Host CPU_TYPE CPU_COUNT MEMORY_REAL
HF 1 Intel(R) Xeon(R) @ 2.70GHz 12 24504164 kB

HF 2 Intel(R) Xeon(R) @2.70GHz 12 24504164 kB

HF 3 Intel(R) Xeon(R) @2.70GHz 12 24504164 kB

HF n Intel(R) Xeon(R) @ 2.70GHz 12 24504164 kB

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your join doesn't have a field to join on, such as the host name of your HFs.

Even better, don't use join if all you want is to filter one search by another search:

generating search for your hardware stuff [search for your HFs | dedup hostname | table hostname | rename hostname as host]
| rex, extract, table, whatever

View solution in original post

0 Karma

woodcock
Esteemed Legend

The easiest way (AND FREE) is to enable platform instrumentation which will start populating the _introspection index (disabled by default) by following these steps:
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/ConfigurePIF

Then search like this:

index="_introspection" AND sourcetype="splunk_resource_usage"

Here are some other ways, too:
https://answers.splunk.com/answers/423998/is-there-an-easy-way-to-get-resource-usage-per-spl.html

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Your join doesn't have a field to join on, such as the host name of your HFs.

Even better, don't use join if all you want is to filter one search by another search:

generating search for your hardware stuff [search for your HFs | dedup hostname | table hostname | rename hostname as host]
| rex, extract, table, whatever
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...