https://community.splunk.com/t5/Monitoring-Splunk/Search-head-CPU-Utilization/m-p/20434#M225 <P>How can I find out what is taking up the CPU on a search head? Yesterday the utilization was 20% on avg., and today it is 80%.</P> Thu, 05 Apr 2012 17:01:59 GMT gharpe2 2012-04-05T17:01:59Z https://community.splunk.com/t5/Monitoring-Splunk/Search-head-CPU-Utilization/m-p/20434#M225 <P>How can I find out what is taking up the CPU on a search head? Yesterday the utilization was 20% on avg., and today it is 80%.</P> Thu, 05 Apr 2012 17:01:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/Search-head-CPU-Utilization/m-p/20434#M225 gharpe2 2012-04-05T17:01:59Z https://community.splunk.com/t5/Monitoring-Splunk/Search-head-CPU-Utilization/m-p/20435#M226 <P>Install sos app on the Search-head, enable the ps_sos.sh scritped input.<BR /> It will collect measures cpu/memory per splunk process, you may be able to see the detail. (if this is splunkd, splunkweb, or user searches)</P> <P><A href="http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk">http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk</A></P> Thu, 05 Apr 2012 17:48:34 GMT https://community.splunk.com/t5/Monitoring-Splunk/Search-head-CPU-Utilization/m-p/20435#M226 yannK 2012-04-05T17:48:34Z https://community.splunk.com/t5/Monitoring-Splunk/Search-head-CPU-Utilization/m-p/20436#M227 <P>The default search app has 2 dashboards which will tell you CPU utilization issues related to indexing and searching. They can be accessed by:</P> <P>http://<YOUR_SERVER>:8000/en-US/app/search/search_detail_activity<BR /> http://<YOUR_SERVER>:8000/en-US/app/search/index_status</YOUR_SERVER></YOUR_SERVER></P> <P>Also, what version of Splunk are you using? I had similar issues when I upgraded from 4.2 to 4.3. Then I upgraded to 4.3.1 and the problem went away.</P> Mon, 28 Sep 2020 11:38:22 GMT https://community.splunk.com/t5/Monitoring-Splunk/Search-head-CPU-Utilization/m-p/20436#M227 jt_splunk 2020-09-28T11:38:22Z