Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Disk, CPU and Memory Details of SplunkCloud or On-prem Search Head Copy


				| rest splunk_server=local /services/server/info 
| table splunk_server numberOfCores numberOfVirtualCores os_build physicalMemoryMB 
| appendcols 
    [| rest splunk_server=local /services/server/status/partitions-space 
    | table splunk_server mount_point available capacity ] 
| eval freeDiskGB=available/1024, totalDiskGB=capacity/1024 
| table splunk_server numberOfCores numberOfVirtualCores os_build physicalMemoryMB mount_point freeDiskGB totalDiskGB 
| addcoltotals freeDiskGB totalDiskGB

0 comments

[0]

Splunk Search for CPU usage over time on Linux machine Copy


				sourcetype=top pctCPU=* | timechart sum(pctCPU) as pctCPU by host

0 comments

[0]