topic Re: 'Memory Usage on Splunk server in Alerting

'Memory Usage on Splunk server

SabariRajanT — Thu, 30 Jul 2020 07:04:36 GMT

There are 3 indexer, In which CPU usage is 99.77, 99.72, 99.61 respectively. Data is not getting indexed. any possible solution for this to resolve and troubleshoot?

Looking forward quick help

Re: 'Memory Usage on Splunk server

burwell — Thu, 30 Jul 2020 07:17:22 GMT

Hmm. Have you looked at the Splunkd.log on these indexers? What else is running? Could it be there is so much searching there are no free cycles? Does /bar/log/messages offer any hints?

Re: 'Memory Usage on Splunk server

SabariRajanT — Thu, 30 Jul 2020 08:13:27 GMT

I see DatabaseDirectoryManager, BucketMover,CMSlave, IndexerIf, S2SFileReceiver under var/log/messages.

Re: 'Memory Usage on Splunk server

burwell — Thu, 30 Jul 2020 17:43:38 GMT

So what's your architecture? How much data are your indexers indexing each day? How many indexers do you have? Are there other indexers that are not having cpu issues?

I think a lot more info is needed here.

Re: 'Memory Usage on Splunk server

gjanders — Fri, 31 Jul 2020 02:30:01 GMT

Have you had a look at https://docs.splunk.com/Documentation/Splunk/latest/DMC/ResourceusageDeployment and attempted to identify if it is search related to splunkd or similar?