29 Premium Themes
Included with purchase — and more features on the way!
Get access — $12 once
Version 2 is coming soon.
The price goes up when it arrives.
Pay once today and every update after that is free.
One Dark Pro
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Andromeda
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Ayu Dark
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Ayu Mirage
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Ayu Light
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Cobalt2
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Night Owl
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Night Owl Light
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Azureus
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Bordo
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Hibernus
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Lilac
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Lux
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Minimus
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Obscuro
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Sereno
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Uva
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Noctis Viola
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Palenight
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Pico 8
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Shades of Purple
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Shades of Purple SD
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Synthwave '84
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Tokyo Night
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Tokyo Night Storm
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Tokyo Night Light
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Winter is Coming
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Winter is Coming Light
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt
Winter is Coming Dark
# CPU/Memory usage
`dmc_set_index_introspection` sourcetype=splunk_resource_usage component=Hostwide host=* | eval CPU_Usage=('data.cpu_system_pct' + 'data.cpu_user_pct') | timechart avg(CPU_Usage) by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| timechart limit=0 useother=f span=30s avg(cpu_user_pct) AS avg,max(cpu_user_pct) AS max by host
index=_introspection host=* sourcetype=splunk_resource_usage component=Hostwide
| `drop_dm_object_name("data")`
| eval used_pct=round((mem_used/mem)*100,2)
| eval swap_used_pct=round((swap_used/swap)*100,2)
| timechart limit=0 useother=f span=1m max(used_pct) AS max_used,max(swap_used_pct) AS max_swap_used by host
# https://github.com/getkub/SplunkScriplets/blob/master/docs/splunk_tips/searches/cpu_memory.txt