Monitoring Splunk

How can I get the memory usage data of an indexer for the last 30 days per day?

Ganta
New Member

Hi Team, I am checking for memory usage of an indexer by using:

| rest splunk_server=MONSPKPRDCI08 /services/server/status/resource-usage/splunk-processes
| eval sid = 'search_props.sid'
| `dmc_classify_processes`
| eval x="memory_usage"
| chart sum(mem_used) AS "Memory Usage" over x by process_class 

But it's giving me the average memory usage for last 30 days and I need data on individual days. Can you please suggest how can I get it?
Thank You

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The documentation for the resource-usage call makes me think only the current usage is returned. Looking at the output seems to confirm that as there is no timestamp field in the data. I think the expectation is you will create a scheduled search that invokes resource-usage at intervals and saves the results in a summary index for later report generation.

There is another way. Try this search to get historical memory use (as a percentage).

index=_introspection component=PerProcess | rename data.process as process, data.pct_memory as mem_used | `dmc_classify_processes` | timechart max(mem_used) by process
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...