How to check the memory usage of a user in Splunk?

[akarivaratharaj]

In Splunk, each user role would be allocated with threshold memory limit. Once we exceeds the limit (in the form of running many/large search queries), we probably end with the error "Waiting for queued job to start".

Is there a way to check the memory usage of my user profile (and/or other specific user) in Splunk?

I would like to check the usage details, as it helps me to optimise my search and obviously it helps me in avoiding the error.

I tried to find from the logs of `_internal` index, but unable to find the exact information. 

Could anyone please help on this.

[akarivaratharaj]

Could anyone please help me on this?

[isoutamo]

Hi

If you have Splunk version 8.x.x or older then you can try to found those from _introspection index like here is described https://community.splunk.com/t5/Monitoring-Splunk/Can-we-find-out-what-the-memory-usage-is-for-our-q...

Unfortunately I cannot found that information anymore from 9.0.1. Also MC shows nothing on 9.0.1 instance on Searches - Search Activity: Instance panel.

r. Ismo

updated: This could be some macOS issue as I could found that sourcetype on clean Linux 9.0.1 version?