Monitoring Splunk

Monitor CPU, Disk and Ram.

fsrodriguez
New Member

How can I create a radial gauge that would display CPU? and what would be the command for Disk and RAM?

Thank you in Advance.

Tags (2)
0 Karma
1 Solution

sbbadri
Motivator

@fsrodriguez

please download https://splunkbase.splunk.com/app/833/#/details.

1) Deploy this Splunk_TA_nix to the servers were you have to monitor
2) Enable CPU,RAM and DISK script
3) restart the server.
4) you will get the data under os index.

or

Try with NMON . It will pull you all necessary metrics from linux hosts ( except HPUX os)
https://splunkbase.splunk.com/app/3248/ - TA-nmon - need to be install/deployed on UF / hosts
https://splunkbase.splunk.com/app/1753/ - NMON APP - need to be installed or deployed on SH (But look for data model settings)

I hope this helps you.

View solution in original post

0 Karma

sbbadri
Motivator

@fsrodriguez

please download https://splunkbase.splunk.com/app/833/#/details.

1) Deploy this Splunk_TA_nix to the servers were you have to monitor
2) Enable CPU,RAM and DISK script
3) restart the server.
4) you will get the data under os index.

or

Try with NMON . It will pull you all necessary metrics from linux hosts ( except HPUX os)
https://splunkbase.splunk.com/app/3248/ - TA-nmon - need to be install/deployed on UF / hosts
https://splunkbase.splunk.com/app/1753/ - NMON APP - need to be installed or deployed on SH (But look for data model settings)

I hope this helps you.

0 Karma

fsrodriguez
New Member

I already had Splunk_TA_nix Installed. Thank you so much!

This is all I had to do:
host="app-1" source="cpu" | gauge cpu_load_percent 25 50 65 75 85 95 100

0 Karma

niketn
Legend

@ fsrodriguez, can you try the following run anywhere search?

| makeresults
| head 1
| eval yourCPUFieldName=14.2
| gauge yourCPUFieldName 0 10 30 50

If the same works you need to replace | makeresults with your base search to get CPU Value.
| head 1 gets only the latest result for CPU
If you want the CPU for multiple hosts you can leverage the Trellis Layout, provided your are on Splunk Enterprise version 6.6 or later.

PS: I have used run anwhere dashboard to use Splunk's _introspection index to get the CPU percent. Also I have used date_hour in the query and also for Trellis split by <option name="trellis.splitBy">date_hour</option>. You would need to replace your query and also convert from date_hour to host

<dashboard>
  <label>Radial Gauge for CPU</label>
  <row>
    <panel>
      <title>CPU by date_hour</title>
      <chart>
        <search>
          <query>index="_introspection" sourcetype="splunk_resource_usage" data.pct_cpu=*
| stats latest(data.pct_cpu) as CPU by date_hour</query>
          <earliest>-4h@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.rangeValues">[0,60,85,100]</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">["0x84E900","0xFFE800","0xBF3030"]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">none</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">date_hour</option>
      </chart>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

fsrodriguez
New Member

Yes I've seen that documentation, thank you. I know how to create it but I don't know how to pull the data values I need. CPU RAM and MEM.

0 Karma

nickhills
Ultra Champion

The links above detail how to chart the data if you have it, but Is your question:
How do I get CPU/Disk/Ram metrics into Splunk?

If so, can you detail which operating systems you are interested in monitoring?

If my comment helps, please give it a thumbs up!
0 Karma

fsrodriguez
New Member

I'm trying to pull it from an Amazon Linux AMI.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...