Is it possible to relate the issues displayed in Splunk UI to OS data or Splunk logs?

nouraali — Thu, 23 Jun 2022 21:03:55 GMT

Hello,

Is it possible to relate the issues displayed in Splunk UI (attached below) to OS data or Splunk logs:

In other words,
Given the OS metrics(RAM,CPU,SWAP,....) of the servers hosting Splunk and Splunk logs, can we relate some trends in this data to below issues:

The percentage of high priority searches lagged (33%) over the last 24 hours is very high and exceeded the yellow thresholds (10%) on this Splunk instance. Total Searches that were part of this percentage=18. Total lagged Searches=6
The percentage of small buckets created over the last hour is high and exceeded the red thresholds for index=..., and possibly more indexes, on this indexer. At the time this alert fired, total buckets created=13, small buckets=11
The percentage of non high priority searches delayed (54%) over the last 24 hours is very high and exceeded the red thresholds (20%) on this Splunk instance. Total Searches that were part of this percentage=574144. Total delayed Searches=314696
Search peer down
Disk space/file system under this mount point ... is exceeding the limits 80%

Would really appreciate your response.

topic Is it possible to relate the issues displayed in Splunk UI to OS data or Splunk logs? in Monitoring Splunk

Is it possible to relate the issues displayed in Splunk UI to OS data or Splunk logs?