I would like to set up the Splunk on Splunk app to monitor the resource usage (CPU and memory) of Splunk on my search-head and on my search peers.
How would I go about doing that?
As of Splunk on Splunk 2.0, SoS ships with the ps_sos.sh
scripted input which once enabled, allows you to track the CPU and memory usage of the main Splunk components :
Note: Currently, this scripted input only exists on Linux and Unix. A similar functionality for Windows will be added in a future SoS release.
Also: You do not need to install the SoS technology add-on on an instance where SoS is already installed.
The ps_sos.sh
data input ships both with the SoS app and with the SoS technology add-on for Unix and Linux.
ps_sos.sh
scripted input by one of the following methods:a) Go to Manager > Data Inputs > Scripts. Enable the ps_sos.sh
data input.
or
b) Run the following command from a terminal window:
$SPLUNK_HOME/bin/splunk _internal call '/servicesNS/nobody/sos/data/inputs/script/.%252Fbin%252Fps_sos.sh' -post:disabled 0
ps_sos.sh
scripted input by one of the following methods:a) If Splunkweb is running, go to Manager > Data Inputs > Scripts. Enable the ps_sos.sh
data input.
or
b) Run the following command from a terminal window:
$SPLUNK_HOME/bin/splunk _internal call '/servicesNS/nobody/TA-sos/data/inputs/script/.%252Fbin%252Fps_sos.sh' -post:disabled 0
Going forward, you will be able to track the CPU and memory usage of Splunk in the "Splunk CPU/Memory Usage" SoS view. Per-search memory usage for the biggest memory-consuming searches can be consulterd in the "Distributed Searches Memory Usage" view.
For further information on deployment best practices for SoS, please refer to this Splunk Answer.
As of Splunk on Splunk 2.0, SoS ships with the ps_sos.sh
scripted input which once enabled, allows you to track the CPU and memory usage of the main Splunk components :
Note: Currently, this scripted input only exists on Linux and Unix. A similar functionality for Windows will be added in a future SoS release.
Also: You do not need to install the SoS technology add-on on an instance where SoS is already installed.
The ps_sos.sh
data input ships both with the SoS app and with the SoS technology add-on for Unix and Linux.
ps_sos.sh
scripted input by one of the following methods:a) Go to Manager > Data Inputs > Scripts. Enable the ps_sos.sh
data input.
or
b) Run the following command from a terminal window:
$SPLUNK_HOME/bin/splunk _internal call '/servicesNS/nobody/sos/data/inputs/script/.%252Fbin%252Fps_sos.sh' -post:disabled 0
ps_sos.sh
scripted input by one of the following methods:a) If Splunkweb is running, go to Manager > Data Inputs > Scripts. Enable the ps_sos.sh
data input.
or
b) Run the following command from a terminal window:
$SPLUNK_HOME/bin/splunk _internal call '/servicesNS/nobody/TA-sos/data/inputs/script/.%252Fbin%252Fps_sos.sh' -post:disabled 0
Going forward, you will be able to track the CPU and memory usage of Splunk in the "Splunk CPU/Memory Usage" SoS view. Per-search memory usage for the biggest memory-consuming searches can be consulterd in the "Distributed Searches Memory Usage" view.
For further information on deployment best practices for SoS, please refer to this Splunk Answer.
Yes, except that you should install the S.o.S technology add-on for Windows on your search peers and the script to be enabled is ps_sos.ps1
.
Are the instructions for monitoring the resource usage for Windows the same?