How to reduce CPU Usage and find the users/resources causing issues?

[SplunkDash]

Hello,

CPU usage is showing very high more than 92% in monitor console. How do we know which resources causing those issues. If this is due to real time search or executing search queries (or running schedule search/reports), how do we know which users (or searches) are causing that issues. We have a several number of users and remotely using/accessing to SPLUNK SH/Reports and perform search queries and schedule search/reports based on their requirements. Any recommendation will be highly appreciated. Thank you!

[richgalloway · Accepted solution]

The Monitoring Console should answer most if not all of your questions.  Go to Resource Usage->CPU Usage:Instance then scroll down to the "Median CPU Usage of Searches" panel.  Split the data by search type or user to see what the heavy hitters are.