topic Re: How to view the currently running search of Splunk and display the amount of memory consumed during search command? in Splunk Search

How to view the currently running search of Splunk and display the amount of memory consumed during search command?

spl_stu — Wed, 26 Apr 2023 12:52:32 GMT

How to view the currently running search of Splunk and display the amount of memory consumed during the execution of this search command? Based on this information, I would like to pause some searches with high memory usage.

Re: How to view the currently running search of Splunk and display the amount of memory consumed during the execution of

gcusello — Wed, 26 Apr 2023 06:31:34 GMT

Hi @spl_stu,

as you can read at https://docs.splunk.com/Documentation/Splunk/9.0.4/RESTREF/RESTsearch#search.2Fjobs , you can use REST API to extract this kind of information.

So try:

| REST /services/search/jobs

Then you can choose the information you need.

Ciao.

Giuseppe

Re: How to view the currently running search of Splunk and display the amount of memory consumed during the execution of

spl_stu — Fri, 05 May 2023 02:37:41 GMT

Okay, thank you for your suggestion. This issue has been resolved so far.

Re: How to view the currently running search of Splunk and display the amount of memory consumed during the execution of

gcusello — Fri, 05 May 2023 05:39:25 GMT

Hi @spl_stu,

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: How to view the currently running search of Splunk and display the amount of memory consumed during search command?

gjanders — Sat, 06 May 2023 09:14:38 GMT

Alerts for splunk admins has an example for historical searches using the introspection data. Refer to my signature for a link