Splunk search for Available CPU and Memory
Copy
| rest /services/server/status/resource-usage/hostwide | eval cpu_count = if(isnull(cpu_count), "N/A", cpu_count), cpu_usage = (cpu_system_pct + cpu_user_pct), mem_used_pct = round((mem_used/mem)*100 , 2), mem_used = tostring(round(mem_used/1024, 3),"commas"), mem = tostring(round(mem/1024, 0),"commas") | fields splunk_server, cpu_count, cpu_usage, mem, mem_used, mem_used_pct | sort - cpu_usage, - mem_used_pct | rename splunk_server AS "Splunk Server", cpu_count AS "CPU Cores", cpu_usage AS "CPU Used (%)", mem AS "Memory Capacity (GB)", mem_used AS "Memory Used (GB)", mem_used_pct AS "Memory Used (%)"
This search will provide resource utilization metrics for any Splunk instances that are a search peer of the SH it is run on. Specifically, this search will show the number of CPU cores, available Memory, used CPU percentage and used Memory percentage. In order to run this search you must have the rest_properties_get capability.
0 comments
[0]
[0]
[0]
[0]
Sign in or Register to submit a comment