Splunk Search

Search string to method to determine heavy hitter servers by operating system

OMohi
Path Finder

Hi:

Is there a procedure or a search string to determine heavy hitter hostname based on operating system. We work on five different operating systems and would like to determine the usage based per os level.

Thanks,
Obaid

0 Karma

sowings
Splunk Employee
Splunk Employee

Try the metrics.log. During each metrics dump (every 30 seconds), the "top X biggest Y" are written out. Where X is defaulted to ten (10), and Y is sourcetype, host, index, etc. The search string would read like:


index=_internal source=*metrics.log group=tcpin_connections | stats sum(kb) AS kb by os

You could also use the results from the os field in the tcpin_connections, to evaluate the OS while getting the accurate license usage from license_usage.log.

0 Karma

OMohi
Path Finder

could you break down the search to specify heavy hitters by host build using a particular o/s (eg windows)

0 Karma

OMohi
Path Finder

Yes you r right. I am assuming licensing usage by operating system, split down by hostnames which has the os installed.

0 Karma

sowings
Splunk Employee
Splunk Employee

Assuming you mean license usage?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could tag your hostnames with the OS, and split your query by that tag. Alternatively, you can do the same with a lookup.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...