Alerting

How to check the memory usage of a user in Splunk?

akarivaratharaj
Communicator

In Splunk, each user role would be allocated with threshold memory limit. Once we exceeds the limit (in the form of running many/large search queries), we probably end with the error "Waiting for queued job to start".

Is there a way to check the memory usage of my user profile (and/or other specific user) in Splunk?

I would like to check the usage details, as it helps me to optimise my search and obviously it helps me in avoiding the error.

I tried to find from the logs of `_internal` index, but unable to find the exact information. 

Could anyone please help on this.

Tags (1)
0 Karma

akarivaratharaj
Communicator

Could anyone please help me on this?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If you have Splunk version 8.x.x or older then you can try to found those from _introspection index like here is described https://community.splunk.com/t5/Monitoring-Splunk/Can-we-find-out-what-the-memory-usage-is-for-our-q...

Unfortunately I cannot found that information anymore from 9.0.1. Also MC shows nothing on 9.0.1 instance on Searches - Search Activity: Instance panel.

r. Ismo

updated: This could be some macOS issue as I could found that sourcetype on clean Linux 9.0.1 version?

Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...