Alerting

How to check the memory usage of a user in Splunk?

akarivaratharaj
Communicator

In Splunk, each user role would be allocated with threshold memory limit. Once we exceeds the limit (in the form of running many/large search queries), we probably end with the error "Waiting for queued job to start".

Is there a way to check the memory usage of my user profile (and/or other specific user) in Splunk?

I would like to check the usage details, as it helps me to optimise my search and obviously it helps me in avoiding the error.

I tried to find from the logs of `_internal` index, but unable to find the exact information. 

Could anyone please help on this.

Tags (1)
0 Karma

akarivaratharaj
Communicator

Could anyone please help me on this?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If you have Splunk version 8.x.x or older then you can try to found those from _introspection index like here is described https://community.splunk.com/t5/Monitoring-Splunk/Can-we-find-out-what-the-memory-usage-is-for-our-q...

Unfortunately I cannot found that information anymore from 9.0.1. Also MC shows nothing on 9.0.1 instance on Searches - Search Activity: Instance panel.

r. Ismo

updated: This could be some macOS issue as I could found that sourcetype on clean Linux 9.0.1 version?

Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...