topic Re: Splunk high CPU utlization investigation in Monitoring Splunk

Splunk high CPU utlization investigation

aaronkorn — Mon, 06 May 2013 13:20:25 GMT

Is there a way to track a particular Splunk PID on the search head to see which search/action is being ran to track utilization?

Re: Splunk high CPU utlization investigation

kristian_kolb — Mon, 06 May 2013 14:42:16 GMT

Have you looked at the built-in statistics for this (in the Search App)? From the menu bar, choose;

Status -> Search Activity -> Search Activity Overview

Status -> Search Activity -> Search Detail

Could prove useful.

Re: Splunk high CPU utlization investigation

aaronkorn — Tue, 07 May 2013 13:25:28 GMT

Yeah I know about that but there are searches that are using a high amount of CPU and want to investigate who is running them and what they are doing. Is this logged in the _internal index? I know when you inspect a search it tells you the PID.

Re: Splunk high CPU utlization investigation

splunkIT — Fri, 31 May 2013 16:11:22 GMT

Have you tried to install the S.o.S app to see if it will help in providing more insight to your splunk instance?

http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk