You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1151 lines
42 KiB
1151 lines
42 KiB
{
|
|
"modelName": "Introspection_Usage",
|
|
"displayName": "Introspection Usage",
|
|
"description": "Introspection Data Model for Resource Usage",
|
|
"objectSummary": {
|
|
"Event-Based": 4,
|
|
"Transaction-Based": 0,
|
|
"Search-Based": 0
|
|
},
|
|
"objects": [
|
|
{
|
|
"objectName": "Introspection",
|
|
"displayName": "Introspection",
|
|
"parentName": "BaseEvent",
|
|
"fields": [
|
|
{
|
|
"fieldName": "data.args",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "data_args",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_idle_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_idle_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_system_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_system_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_user_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_user_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.fd_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "fd_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.mem_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mem_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.normalized_load_avg_1min",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "normalized_load_avg_1min",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.pct_cpu",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "pct_cpu",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.pct_memory",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "pct_memory",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.process",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "process",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.app",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "app",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.args",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "search_args",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.mode",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mode",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.user",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "user",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.swap_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "swap_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.mount_point",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mount",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "_time",
|
|
"owner": "BaseEvent",
|
|
"type": "timestamp",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "_time",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "host",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "host",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "source",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "source",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "sourcetype",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "sourcetype",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
}
|
|
],
|
|
"calculations": [],
|
|
"constraints": [
|
|
{
|
|
"search": "index=_introspection",
|
|
"owner": "Introspection"
|
|
}
|
|
],
|
|
"lineage": "Introspection"
|
|
},
|
|
{
|
|
"objectName": "Disk_Objects",
|
|
"displayName": "Disk Objects",
|
|
"parentName": "Introspection",
|
|
"fields": [
|
|
{
|
|
"fieldName": "data.args",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "data_args",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_idle_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_idle_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_system_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_system_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_user_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_user_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.fd_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "fd_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.mem_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mem_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.normalized_load_avg_1min",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "normalized_load_avg_1min",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.pct_cpu",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "pct_cpu",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.pct_memory",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "pct_memory",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.process",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "process",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.app",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "app",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.args",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "search_args",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.mode",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mode",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.user",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "user",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.swap_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "swap_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.mount_point",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mount",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "_time",
|
|
"owner": "BaseEvent",
|
|
"type": "timestamp",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "_time",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "host",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "host",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "source",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "source",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "sourcetype",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "sourcetype",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
}
|
|
],
|
|
"calculations": [
|
|
{
|
|
"outputFields": [
|
|
{
|
|
"fieldName": "Capacity",
|
|
"owner": "Introspection.Disk_Objects",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "Capacity",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
}
|
|
],
|
|
"calculationID": "ap8ojhsynvj",
|
|
"owner": "Introspection.Disk_Objects",
|
|
"editable": true,
|
|
"comment": "",
|
|
"calculationType": "Eval",
|
|
"expression": "round('data.capacity'/1024,2)"
|
|
},
|
|
{
|
|
"outputFields": [
|
|
{
|
|
"fieldName": "Avail",
|
|
"owner": "Introspection.Disk_Objects",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "Avail",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
}
|
|
],
|
|
"calculationID": "hvv0j0v4aw",
|
|
"owner": "Introspection.Disk_Objects",
|
|
"editable": true,
|
|
"comment": "",
|
|
"calculationType": "Eval",
|
|
"expression": "round('data.free'/1024,2)"
|
|
},
|
|
{
|
|
"outputFields": [
|
|
{
|
|
"fieldName": "Used",
|
|
"owner": "Introspection.Disk_Objects",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "Used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
}
|
|
],
|
|
"calculationID": "e74nw43q038",
|
|
"owner": "Introspection.Disk_Objects",
|
|
"editable": true,
|
|
"comment": "",
|
|
"calculationType": "Eval",
|
|
"expression": "round((Capacity-Avail),2)"
|
|
},
|
|
{
|
|
"outputFields": [
|
|
{
|
|
"fieldName": "UsedPct",
|
|
"owner": "Introspection.Disk_Objects",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "UsedPct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
}
|
|
],
|
|
"calculationID": "7fbamd5whnf",
|
|
"owner": "Introspection.Disk_Objects",
|
|
"editable": true,
|
|
"comment": "",
|
|
"calculationType": "Eval",
|
|
"expression": "round((Used/Capacity)*100,2)"
|
|
}
|
|
],
|
|
"constraints": [
|
|
{
|
|
"search": "sourcetype=splunk_disk_objects component=Partitions",
|
|
"owner": "Introspection.Disk_Objects"
|
|
}
|
|
],
|
|
"lineage": "Introspection.Disk_Objects"
|
|
},
|
|
{
|
|
"objectName": "Hostwide_Resource_Usage",
|
|
"displayName": "Hostwide Resource Usage",
|
|
"parentName": "Introspection",
|
|
"fields": [
|
|
{
|
|
"fieldName": "data.args",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "data_args",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_idle_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_idle_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_system_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_system_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_user_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_user_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.fd_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "fd_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.mem_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mem_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.normalized_load_avg_1min",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "normalized_load_avg_1min",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.pct_cpu",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "pct_cpu",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.pct_memory",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "pct_memory",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.process",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "process",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.app",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "app",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.args",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "search_args",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.mode",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mode",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.user",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "user",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.swap_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "swap_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.mount_point",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mount",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "_time",
|
|
"owner": "BaseEvent",
|
|
"type": "timestamp",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "_time",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "host",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "host",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "source",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "source",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "sourcetype",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "sourcetype",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
}
|
|
],
|
|
"calculations": [
|
|
{
|
|
"outputFields": [
|
|
{
|
|
"fieldName": "pct_cpu_used",
|
|
"owner": "Introspection.Hostwide_Resource_Usage",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "pct_cpu_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
}
|
|
],
|
|
"calculationID": "ztotitvz5t7",
|
|
"owner": "Introspection.Hostwide_Resource_Usage",
|
|
"editable": true,
|
|
"comment": "",
|
|
"calculationType": "Eval",
|
|
"expression": "round(100-'data.cpu_idle_pct',2)"
|
|
}
|
|
],
|
|
"constraints": [
|
|
{
|
|
"search": "sourcetype=splunk_resource_usage component=Hostwide",
|
|
"owner": "Introspection.Hostwide_Resource_Usage"
|
|
}
|
|
],
|
|
"lineage": "Introspection.Hostwide_Resource_Usage"
|
|
},
|
|
{
|
|
"objectName": "PerProcess_Resource_Usage",
|
|
"displayName": "PerProcess Resource Usage",
|
|
"parentName": "Introspection",
|
|
"fields": [
|
|
{
|
|
"fieldName": "data.args",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "data_args",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_idle_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_idle_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_system_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_system_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.cpu_user_pct",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "cpu_user_pct",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.fd_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "fd_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.mem_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mem_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.normalized_load_avg_1min",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "normalized_load_avg_1min",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.pct_cpu",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "pct_cpu",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.pct_memory",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "pct_memory",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.process",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "process",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.app",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "app",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.args",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "search_args",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.mode",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mode",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.search_props.user",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "user",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.swap_used",
|
|
"owner": "Introspection",
|
|
"type": "number",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "swap_used",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "data.mount_point",
|
|
"owner": "Introspection",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "mount",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "_time",
|
|
"owner": "BaseEvent",
|
|
"type": "timestamp",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "_time",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "host",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "host",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "source",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "source",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
},
|
|
{
|
|
"fieldName": "sourcetype",
|
|
"owner": "BaseEvent",
|
|
"type": "string",
|
|
"required": false,
|
|
"multivalue": false,
|
|
"hidden": false,
|
|
"editable": true,
|
|
"displayName": "sourcetype",
|
|
"comment": "",
|
|
"fieldSearch": ""
|
|
}
|
|
],
|
|
"calculations": [],
|
|
"constraints": [
|
|
{
|
|
"search": "sourcetype=splunk_resource_usage component=PerProcess",
|
|
"owner": "Introspection.PerProcess_Resource_Usage"
|
|
}
|
|
],
|
|
"lineage": "Introspection.PerProcess_Resource_Usage"
|
|
}
|
|
],
|
|
"objectNameList": [
|
|
"Introspection",
|
|
"Disk_Objects",
|
|
"Hostwide_Resource_Usage",
|
|
"PerProcess_Resource_Usage"
|
|
]
|
|
}
|