I have an application that uses several applications, and I need to report on the overall RAM Usage. I am using uberAgent on the Splunk Enterprise 6.68. Below is what I have so far, but I want to be able to report on it by host. For example:
hostname | Application1 | Application2 | Application3 | Total RAM Usage
host1 | 100MB | 125MB | 95MB | 320MB
host2 | 200MB | 225MB | 195MB | 620MB
| pivot uberAgent Process_ProcessDetail
sum(ProcCPUTimeS) as ProcCPUTimeS
sum(ProcCPUPercent) as ProcCPUPercent
sum(ProcWorkingSetMB) as ProcWorkingSetMB
values(ProcName) as ProcName
splitrow AppName as "App name"
host as host filter host in (*)
filter AppName in ("Application 1", "Application 2", "Application 3")
| stats
sum(ProcCPUTimeS) AS SumProcCPUTimeS
avg(ProcCPUPercent) AS FuncProcCPUPercent
avg(ProcWorkingSetMB) as FuncProcWorkingSetMB
values(ProcName) as "Process name(s)" by "App name"
| eval "Total CPU time (s)"=round (SumProcCPUTimeS,1)
| eval "Avg. CPU (%)"=round (FuncProcCPUPercent,1)
| eval "Total IO (MB)"=round (SumProcIOMB,1)
| eval "Avg. RAM (MB)"=round (FuncProcWorkingSetMB,0)
| eval sortfield=lower ('App name')
| eventstats sum("Avg. RAM (MB)") as total
| eval "Total Memory Usage" = round(total/1024/1024/1024*100,2)
| table "Total Memory Usage" host "App name" "Process name(s)" sortfield
| sort limit=0 sortfield
| fields - sortfield
