'Memory Usage on Splunk server

[SabariRajanT]

There are 3 indexer, In which CPU usage is 99.77, 99.72, 99.61 respectively.  Data is not getting indexed. any possible solution for this to resolve and troubleshoot?

Looking forward quick help

[burwell · Accepted solution]

Hmm. Have you looked at the Splunkd.log on these indexers? What else is running? Could it be there is so much searching there are no free cycles? Does /bar/log/messages offer any hints?

[SabariRajanT]

I see DatabaseDirectoryManager, BucketMover,CMSlave, IndexerIf, S2SFileReceiver under var/log/messages.

[burwell]

So what's your architecture? How much data are your indexers indexing each day? How many indexers do you have? Are there other indexers that are not having cpu issues?

I think a lot more info is needed here.

[gjanders]

Have you had a look at https://docs.splunk.com/Documentation/Splunk/latest/DMC/ResourceusageDeployment and attempted to identify if it is search related to splunkd or similar?