https://community.splunk.com/t5/Monitoring-Splunk/Lots-of-Splunkd-exe-processes/m-p/20568#M231 <P>Note that "small searches on a short interval" can often serve as a "good enough" approximation to real-time searches / alerts. In this instance, the search process (splunkd.exe) would live long enough to complete the search, but would not persist after that. If the search only takes 10s to run, and it's run on a 5 minute basis, the overall memory and CPU footprints would be pretty small.</P> Tue, 05 Feb 2013 17:25:20 GMT sowings 2013-02-05T17:25:20Z https://community.splunk.com/t5/Monitoring-Splunk/Lots-of-Splunkd-exe-processes/m-p/20565#M228 <P>I just found that my Windows server based Splunk console is running 14 splunkd.exe services simultaneously... is this due to the latest version of Splunk (5.0.1) or does this, possibly, have to do with the number of real-time alerts I have configured in the console? Overall, the processes aren't using that much CPU on the average (spikes here and there), but they are using almost a full gig of RAM on my server:</P> <P><IMG src="http://i.imgur.com/U7cvCD9.jpg" /></P> Tue, 05 Feb 2013 17:16:55 GMT https://community.splunk.com/t5/Monitoring-Splunk/Lots-of-Splunkd-exe-processes/m-p/20565#M228 ARothman 2013-02-05T17:16:55Z https://community.splunk.com/t5/Monitoring-Splunk/Lots-of-Splunkd-exe-processes/m-p/20566#M229 <P>Splunk forks a splunkd process (in your case, a .exe) to run each search. One of those processes will be the "main" splunkd, the rest will be as the result of a search, such as a dashboard, or the real time alerts you've described.</P> Tue, 05 Feb 2013 17:18:05 GMT https://community.splunk.com/t5/Monitoring-Splunk/Lots-of-Splunkd-exe-processes/m-p/20566#M229 sowings 2013-02-05T17:18:05Z https://community.splunk.com/t5/Monitoring-Splunk/Lots-of-Splunkd-exe-processes/m-p/20567#M230 <P>Hrm... well, if that's the case, looks like I'll either be letting management know that we'll likely have to increase the RAM on this box if they want me to go ahead with creating dozens more real-time alerts... or those alerts simply can't be real-time <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> <P>Thanks for the confirmation.</P> Tue, 05 Feb 2013 17:21:19 GMT https://community.splunk.com/t5/Monitoring-Splunk/Lots-of-Splunkd-exe-processes/m-p/20567#M230 ARothman 2013-02-05T17:21:19Z https://community.splunk.com/t5/Monitoring-Splunk/Lots-of-Splunkd-exe-processes/m-p/20568#M231 <P>Note that "small searches on a short interval" can often serve as a "good enough" approximation to real-time searches / alerts. In this instance, the search process (splunkd.exe) would live long enough to complete the search, but would not persist after that. If the search only takes 10s to run, and it's run on a 5 minute basis, the overall memory and CPU footprints would be pretty small.</P> Tue, 05 Feb 2013 17:25:20 GMT https://community.splunk.com/t5/Monitoring-Splunk/Lots-of-Splunkd-exe-processes/m-p/20568#M231 sowings 2013-02-05T17:25:20Z