topic Resources used by each saved search in Splunk Search

Resources used by each saved search

splunkrocks2014 — Wed, 21 Jun 2017 14:18:01 GMT

Hi. I wanted to find out if Splunk is able to show the CPU and memory usages from each savedsearch.

Thanks.

Re: Resources used by each saved search

gcusello — Wed, 21 Jun 2017 15:35:20 GMT

Hi splunkrocks2014,
using Distributed Monitoring Console at [Search -- Activity -- Search Activity: Instance] you have memory usage and response time, not CPU.
Bye.
Giuseppe

Re: Resources used by each saved search

cmerriman — Wed, 21 Jun 2017 16:01:58 GMT

you might want to tweak this a bit but i saw that the _introspection index had some data surrounding cpu and memory.

index="_introspection"  data.search_props.provenance="scheduler"  |bucket _time span=15m | stats max(data.pct_cpu) as pct_cpu max(data.normalized_pct_cpu) as normalized_pct_cpu max(data.mem_used) as mem_used by data.search_props.label _time

Re: Resources used by each saved search

splunkrocks2014 — Tue, 29 Sep 2020 14:33:53 GMT

Hi cmerriman, this is what I am looking for. I think pct_cpu means "percentage of CPU", but there is some data showing the pct_cpu is greater than 100. Any clues? Thanks.

Re: Resources used by each saved search

cmerriman — Tue, 29 Sep 2020 14:38:19 GMT

this is what i found:

pct_cpu: Percentage of CPU usage, relative to one core. 100% is equivalent to 1 core
normalized_pct_cpu: Percentage of CPU usage across all cores. 100% is equivalent to all CPU resources on the machine.

http://docs.splunk.com/Documentation/Splunk/6.6.0/RESTREF/RESTintrospect#server.2Fstatus.2Fresource-usage.2Fsplunk-processes