How can I know if my heavy forwarder is processing the regex? Bonus: How can I check the memory and CPU consumption?

kteng2024 — Thu, 10 Aug 2017 22:53:46 GMT

Hi ,

I installed a heavy forwarder for regex processing a few source types, not for indexing. How can I know whether the heavy forwarder is processing the regex? How can I check the memory consumption and CPU consumption from the search head or DMC (heavy forwarder is connected to DMC)?

Re: How can I know if my heavy forwarder is processing the regex? Bonus: How can I check the memory and CPU consumption?

sbbadri — Tue, 29 Sep 2020 15:20:05 GMT

Regex processing:

1) If regex is correct , you should see extracted field in interesting fields for that sourcetype by using spl query.
2) from GUI, settings->fields-> field extractions-> search for sourcetype or field name. it should fetch some results

CPU and Memory:

1) Install Splunk_TA_nix splunk Addon. So it will report cpu, memory and other os related stats.
2) Settings->Montoring Console-> Resource Usage-> Resource usage:Instances-> select the instance - for this you need setup montoring console

topic Re: How can I know if my heavy forwarder is processing the regex? Bonus: How can I check the memory and CPU consumption? in Splunk Search

How can I know if my heavy forwarder is processing the regex? Bonus: How can I check the memory and CPU consumption?

Re: How can I know if my heavy forwarder is processing the regex? Bonus: How can I check the memory and CPU consumption?