All Apps and Add-ons

Splunk on Splunk not matching to resources on server

Contributor

My indexers are running 6gb ram and 6 cores. In Splunk on Splunk under CPU/Memory Usage, the graphs for CPU Usage are showing CPU spikes over 600%. How would that be possible? I also see this for my Median Virtual Memory Usage. I see memory spikes over 7,000mb.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

In the panels of the CPU/Memory Usage view, S.o.S expresses CPU usage per process class as a percentage of one CPU core. This means that a CPU usage of 600% is equivalent to 6 CPU cores used - in this case, 100% of system-wide CPU resources.

Virtual memory is typically inclusive of both physical memory (RAM) and swap (disk), which is why it is not unexpected to see it exceed the amount of physical memory installed.

Finally, as @javiergn points out, I strongly recommend to migrate from S.o.S to the Distributed Management Console to monitor your Splunk deployment.

View solution in original post

Splunk Employee
Splunk Employee

In the panels of the CPU/Memory Usage view, S.o.S expresses CPU usage per process class as a percentage of one CPU core. This means that a CPU usage of 600% is equivalent to 6 CPU cores used - in this case, 100% of system-wide CPU resources.

Virtual memory is typically inclusive of both physical memory (RAM) and swap (disk), which is why it is not unexpected to see it exceed the amount of physical memory installed.

Finally, as @javiergn points out, I strongly recommend to migrate from S.o.S to the Distributed Management Console to monitor your Splunk deployment.

View solution in original post

Contributor

that was what i was thinking but needed to be sure before i forward with what i am trying to prove. thank you hexx!

0 Karma

SplunkTrust
SplunkTrust

I know this is not the type of answer you are expecting but if you are running Splunk 6.2 or 6.3, why don't you use the Distributed Management Console instead?

The available dashboards provide insight into your deployment's or instance's

 search performance
 indexing performance
 operating system resource usage
 Splunk app key value store performance
 search head and indexer clustering
 index and volume usage
 forwarder connections
 and license usage.

Contributor

i do not see operating system resource usage in the DM.

0 Karma

Splunk Employee
Splunk Employee

Take a look at the Resource Usage: Machine view.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!