How can I get the memory usage data of an indexer for the last 30 days per day?

[Ganta]

Hi Team, I am checking for memory usage of an indexer by using:

| rest splunk_server=MONSPKPRDCI08 /services/server/status/resource-usage/splunk-processes
| eval sid = 'search_props.sid'
| `dmc_classify_processes`
| eval x="memory_usage"
| chart sum(mem_used) AS "Memory Usage" over x by process_class 

But it's giving me the average memory usage for last 30 days and I need data on individual days. Can you please suggest how can I get it?
Thank You

[richgalloway]

The documentation for the resource-usage call makes me think only the current usage is returned. Looking at the output seems to confirm that as there is no timestamp field in the data. I think the expectation is you will create a scheduled search that invokes resource-usage at intervals and saves the results in a summary index for later report generation.

There is another way. Try this search to get historical memory use (as a percentage).

index=_introspection component=PerProcess | rename data.process as process, data.pct_memory as mem_used | `dmc_classify_processes` | timechart max(mem_used) by process