Hi Team, I am checking for memory usage of an indexer by using:
| rest splunk_server=MONSPKPRDCI08 /services/server/status/resource-usage/splunk-processes
| eval sid = 'search_props.sid'
| `dmc_classify_processes`
| eval x="memory_usage"
| chart sum(mem_used) AS "Memory Usage" over x by process_class
But it's giving me the average memory usage for last 30 days and I need data on individual days. Can you please suggest how can I get it?
Thank You
The documentation for the resource-usage call makes me think only the current usage is returned. Looking at the output seems to confirm that as there is no timestamp field in the data. I think the expectation is you will create a scheduled search that invokes resource-usage at intervals and saves the results in a summary index for later report generation.
There is another way. Try this search to get historical memory use (as a percentage).
index=_introspection component=PerProcess | rename data.process as process, data.pct_memory as mem_used | `dmc_classify_processes` | timechart max(mem_used) by process