There are 3 indexer, In which CPU usage is 99.77, 99.72, 99.61 respectively. Data is not getting indexed. any possible solution for this to resolve and troubleshoot?
Looking forward quick help
Hmm. Have you looked at the Splunkd.log on these indexers? What else is running? Could it be there is so much searching there are no free cycles? Does /bar/log/messages offer any hints?
Hmm. Have you looked at the Splunkd.log on these indexers? What else is running? Could it be there is so much searching there are no free cycles? Does /bar/log/messages offer any hints?
I see DatabaseDirectoryManager, BucketMover,CMSlave, IndexerIf, S2SFileReceiver under var/log/messages.
So what's your architecture? How much data are your indexers indexing each day? How many indexers do you have? Are there other indexers that are not having cpu issues?
I think a lot more info is needed here.
Have you had a look at https://docs.splunk.com/Documentation/Splunk/latest/DMC/ResourceusageDeployment and attempted to identify if it is search related to splunkd or similar?