https://community.splunk.com/t5/Monitoring-Splunk/Splunk-CPU-Usage-Spike-after-upgrade-to-5-0-1/m-p/22186#M240 <P>Look to your limits.conf for the answer, that's what solved the problem for us. Specifically you may need to lower your <CODE>base_max_searches</CODE> if you have it defined. We also used the <CODE>max_searches_perc</CODE> parameter for the <CODE>[scheduler]</CODE> stanza to help limit the amount of searches that the Search Head was issuing to the Indexer at a given time.</P> <P>Here is a quick look at our settings now that are working nicely, obviously you'll want to adjust these to something that makes sense for your architecture.</P> <PRE><CODE>[search] multi_threaded_setup = 1 base_max_searches = 64 [metadata] maxcount=500000 [scheduler] max_searches_perc = 10 </CODE></PRE> Mon, 11 Nov 2013 19:44:38 GMT mcluver 2013-11-11T19:44:38Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-CPU-Usage-Spike-after-upgrade-to-5-0-1/m-p/22183#M237 <P>I upgraded from 4.3.1 to 5.0.1. After starting splunk, it runs fine for a few minutes but then the CPU usage increases rapidly and remains at 99%. I was forced to reinstall 4.3.1 to get functionality back.</P> <P>This issue doesn't occur on 4.3.1, did something drastic change between these two versions? We have a realtime dashboard set up and quite a few (40+) scheduled searches running. There are also 20+ forwarders in the environment. I'm not sure what other details are needed to get to the root of this issue, but I'm happy to provide what I can.</P> <P>Thank you!</P> Wed, 06 Feb 2013 19:27:26 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-CPU-Usage-Spike-after-upgrade-to-5-0-1/m-p/22183#M237 rush05 2013-02-06T19:27:26Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-CPU-Usage-Spike-after-upgrade-to-5-0-1/m-p/22184#M238 <P>We're having a very similar problem, we have a large number of scheduled searches that regularly run. After the upgrade during each run our CPU usage has been through the roof, it looks like they made some <STRONG>HUGE</STRONG> changes to the code.</P> <P>Splunk FAIL. </P> <P>Let's hope 6.x resolved these problems.</P> Fri, 27 Sep 2013 21:19:38 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-CPU-Usage-Spike-after-upgrade-to-5-0-1/m-p/22184#M238 mcluver 2013-09-27T21:19:38Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-CPU-Usage-Spike-after-upgrade-to-5-0-1/m-p/22185#M239 <P>Recently worked with Splunk on a similar issue regarding cpu spike after upgrade to 5.0.3. A workaround was provided but since the issue only occurred after upgrading to 5.0.3 (from 4.3.4) it should be a bug. IOW, no changes to configuration other than upgrade.</P> <P>I hope that someone from Splunk support team can comment here about this bug. </P> Mon, 11 Nov 2013 19:35:54 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-CPU-Usage-Spike-after-upgrade-to-5-0-1/m-p/22185#M239 the_wolverine 2013-11-11T19:35:54Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-CPU-Usage-Spike-after-upgrade-to-5-0-1/m-p/22186#M240 <P>Look to your limits.conf for the answer, that's what solved the problem for us. Specifically you may need to lower your <CODE>base_max_searches</CODE> if you have it defined. We also used the <CODE>max_searches_perc</CODE> parameter for the <CODE>[scheduler]</CODE> stanza to help limit the amount of searches that the Search Head was issuing to the Indexer at a given time.</P> <P>Here is a quick look at our settings now that are working nicely, obviously you'll want to adjust these to something that makes sense for your architecture.</P> <PRE><CODE>[search] multi_threaded_setup = 1 base_max_searches = 64 [metadata] maxcount=500000 [scheduler] max_searches_perc = 10 </CODE></PRE> Mon, 11 Nov 2013 19:44:38 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-CPU-Usage-Spike-after-upgrade-to-5-0-1/m-p/22186#M240 mcluver 2013-11-11T19:44:38Z