topic Splunk resource usage by users/searches in Monitoring Splunk https://community.splunk.com/t5/Monitoring-Splunk/Splunk-resource-usage-by-users-searches/m-p/678528#M10023 <P>Hi all,</P><P>We are seeing a scenario where there are a lot of unoptimised searches, dashboards etc which when run are exhausting our CPU on indexers. If some users run resource intensive adhoc searches/dashboards etc simultaneously, this is becoming a problem as so many searches running together resulting in 'server busy' error at indexer.</P><P>&nbsp;</P><P>1. Is there any way we can throttle CPU/memory usage per user/role/searches?</P><P>2. Are there any documents on optimising searches for better performance and less resource usage?</P> Fri, 23 Feb 2024 18:35:59 GMT jpillai 2024-02-23T18:35:59Z Splunk resource usage by users/searches https://community.splunk.com/t5/Monitoring-Splunk/Splunk-resource-usage-by-users-searches/m-p/678528#M10023 <P>Hi all,</P><P>We are seeing a scenario where there are a lot of unoptimised searches, dashboards etc which when run are exhausting our CPU on indexers. If some users run resource intensive adhoc searches/dashboards etc simultaneously, this is becoming a problem as so many searches running together resulting in 'server busy' error at indexer.</P><P>&nbsp;</P><P>1. Is there any way we can throttle CPU/memory usage per user/role/searches?</P><P>2. Are there any documents on optimising searches for better performance and less resource usage?</P> Fri, 23 Feb 2024 18:35:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-resource-usage-by-users-searches/m-p/678528#M10023 jpillai 2024-02-23T18:35:59Z Re: Splunk resource usage by users/searches https://community.splunk.com/t5/Monitoring-Splunk/Splunk-resource-usage-by-users-searches/m-p/678532#M10024 <P>1. Check out the Workload Management feature.&nbsp; <A href="https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/Admin/WorkloadManagement" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/Admin/WorkloadManagement</A></P><P>2. That's about as much art as it is science.&nbsp; The Search Manual has a chapter on it that should get you started.&nbsp; <A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutoptimization" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutoptimization</A></P> Fri, 23 Feb 2024 19:55:52 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-resource-usage-by-users-searches/m-p/678532#M10024 richgalloway 2024-02-23T19:55:52Z