Alerting

How to check the memory usage of a user in Splunk?

akarivaratharaj
Communicator

In Splunk, each user role would be allocated with threshold memory limit. Once we exceeds the limit (in the form of running many/large search queries), we probably end with the error "Waiting for queued job to start".

Is there a way to check the memory usage of my user profile (and/or other specific user) in Splunk?

I would like to check the usage details, as it helps me to optimise my search and obviously it helps me in avoiding the error.

I tried to find from the logs of `_internal` index, but unable to find the exact information. 

Could anyone please help on this.

Tags (1)
0 Karma

akarivaratharaj
Communicator

Could anyone please help me on this?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

If you have Splunk version 8.x.x or older then you can try to found those from _introspection index like here is described https://community.splunk.com/t5/Monitoring-Splunk/Can-we-find-out-what-the-memory-usage-is-for-our-q...

Unfortunately I cannot found that information anymore from 9.0.1. Also MC shows nothing on 9.0.1 instance on Searches - Search Activity: Instance panel.

r. Ismo

updated: This could be some macOS issue as I could found that sourcetype on clean Linux 9.0.1 version?

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...