https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248790#M9382 <P>On the server, if you see a low CPU usage then check your monitoring service to make sure that it's reporting correctly.</P> Mon, 23 Jan 2017 02:40:55 GMT renjith_nair 2017-01-23T02:40:55Z https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248789#M9381 <P>I have six indexers in cluster and 2 search heads. Only one of my indexers is showing &gt;90% CPU load in some other server monitoring tool even when all my inputs are disabled. Also when I run the top command to check the CPU usage of that particular indexer when all my inputs are disabled it shows only 3% to us. What's the best way to check the CPU load and where am I going wrong?</P> Sat, 21 Jan 2017 10:10:04 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248789#M9381 MousumiChowdhur 2017-01-21T10:10:04Z https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248790#M9382 <P>On the server, if you see a low CPU usage then check your monitoring service to make sure that it's reporting correctly.</P> Mon, 23 Jan 2017 02:40:55 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248790#M9382 renjith_nair 2017-01-23T02:40:55Z https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248791#M9383 <P>The CPU load is is showing up a high percentage &gt;90% on that indexer. How should I check the CPU load and make it less than 90% like my other five indexers? How to find out what is going wrong with that only indexer?</P> Mon, 23 Jan 2017 04:53:35 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248791#M9383 MousumiChowdhur 2017-01-23T04:53:35Z https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248792#M9384 <P>Here is what I would do to identify the issue.</P> <UL> <LI>Go to your master and take a look at the DMC, specifically Indexing -&gt; Performance -&gt; Indexing Performance: Instance (select affected indexer)</LI> <LI>Compare other values from the DMC's Indexing pages with other indexers.</LI> <LI>Are the indexes configured correct? If you're talking about 6 indexers, I would check the replication settings and also the replication of all indexes. Are they all being replicated?</LI> <LI>Are you using VMs? If not, check disk health and IOPS, e.g. with Bonnie++</LI> <LI>In the DMC, you can also take a look at Resource Usage: Instance or Resource Usage: Machine to get some further information.</LI> <LI>Look at htop/iftop when load is high to get some information which process causes the load which or server is being talked to.</LI> </UL> <P>Skalli</P> Tue, 24 Jan 2017 13:31:39 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248792#M9384 skalliger 2017-01-24T13:31:39Z https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248793#M9385 <P>We have a similar situation. Looking at the distribution of the daily license across the six indexers helped us a lot. It's on the license master server at <A href="http://:8000/en-US/manager/system/licensing">licensing</A>.</P> <P>I assume you would expect an even distribution of the license across the six servers. It's interesting to see what it would show you...</P> Wed, 25 Jan 2017 02:16:37 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-is-only-one-of-my-indexers-showing-a-high-CPU-load/m-p/248793#M9385 ddrillic 2017-01-25T02:16:37Z