Alerting

How to set-up an alert when my memory usage goes above 80%?

manja054
Explorer

host=* sourcetype="Perfmon:Memory"

collection=Memory
object=Memory
counter="% Committed Bytes In Use"
Value=27.863303753428205

My stats looks like above and i want to be notified when my memory usage goes above 80%

Tags (2)

stephanefotso
Motivator

Hello! Try a search like this, and save it as an alert.

host=* sourcetype="Perfmon:Memory"  | stats count as mem  count(eval(counter="% Committed Bytes In Use")) as mem_used |eval percentage=round(mem_used/mem,3)*100 | where percentage > 80| fields  mem_used, mem, percentage

Thanks!

SGF

KSinghK
Loves-to-Learn Lots

% Committed Bytes In Use% is not the actual parameter to monitor memory.

 

sourcetype=perfmon* OR sourcetype=winhostmon FreePhysicalMemoryKB="*" i
| eval MemoryUsedPercent=round((TotalPhysicalMemoryKB - FreePhysicalMemoryKB)/TotalPhysicalMemoryKB * 100,2)
| eval MemoryUsedMB=(TotalPhysicalMemoryKB-FreePhysicalMemoryKB)/1024 | Stats count by host

0 Karma

KSinghK
Loves-to-Learn Lots

sourcetype=perfmon* OR sourcetype=winhostmon FreePhysicalMemoryKB="*" index=<your index> 
| eval MemoryUsedPercent=round((TotalPhysicalMemoryKB - FreePhysicalMemoryKB)/TotalPhysicalMemoryKB * 100,2)
| eval MemoryUsedMB=(TotalPhysicalMemoryKB-FreePhysicalMemoryKB)/1024 | stats count by host

 

updated the search just add your index here.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...