Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Windows Memory Usage Metrics Copy


				| mstats avg(_value) as avgValue WHERE metric_name="Memory.*" AND "index"="em_metrics" span=auto by metric_name, host | eval avgValue=avgValue."host".host | xyseries _time metric_name avgValue | rename Memory.* as *, %* as *, */sec as *_per_sec | foreach * [ | rex field=<<FIELD>> "(?P<<<FIELD>>>.+)host(?P<host>.+)$" ]

0 comments

[0]

Splunk Search for Memory usage over time on Linux machine Copy


				sourcetype=top pctMEM=* | timechart sum(pctMEM) as pctMEM by host

0 comments

[0]

Splunk Search for Memory used by search ID Copy


				index="_introspection"  "data.process"=splunkd | timechart max(data.mem_used) as "Memory Used" by data.search_props.sid usenull=f useother=f

0 comments

[0]