topic Re: How to search a list of saved searches that are (historically) consuming high CPU, memory, and take a long time to execute? in Splunk Search

How to search a list of saved searches that are (historically) consuming high CPU, memory, and take a long time to execute?

josf999 — Thu, 08 Sep 2016 20:17:05 GMT

I want a search that will list saved searches that are (historically) consuming high CPU, memory, and take a long time to execute.

sk314 — Thu, 08 Sep 2016 20:57:17 GMT

The Distributed Management Console has a dashboard for a similar search.

It's under the Search Menu -> Activitiy -> Search Usage Statistics : Deployment under the title "Long Running Searches"

Also, Search Menu -> Activity -> Search Activity : Deployment under the title "Top 20 Memory-Consuming Searches"

It has a bunch of other useful dashboards.

josf999 — Fri, 09 Sep 2016 05:55:14 GMT

Thanks a lot sk314.It helped me,Now i need to find the cpu utilization for those searches too,any idea,how to append this query:

sk314 — Fri, 09 Sep 2016 17:29:47 GMT

I am not sure if instrumentation at that resolution is possible/enabled.

josf999 — Fri, 09 Sep 2016 19:20:15 GMT

I thought of taking the query by clicking "open in search" and appending it.