Developing for Splunk Enterprise

hostwide component in resource_usage.log

stanwin
Contributor

What exactly is the hostwide component in below.

It is reporting the very high utilization of memory & subsequently the Splunkd process crashes.

The issue goes away on VM restart, but slowly hits saturation again in around a day..

Is it process in Splunk itself or is it a nix process.

It states: https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Whatdatagetslogged
host-level, dynamic CPU utilization and paging information.

Not much description here: https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTintrospect#server.2Fstatus.2Fresource...

index=_* host=ukwkmh-vmua084 source="/opt/splunk/var/log/introspection/resource_usage.log" sourcetype = splunk_resource_usage

{   [-] 
     component:  Hostwide   
     data:  {   [-] 
         cpu_arch:   x86_64 
         cpu_count:  12 
         cpu_idle_pct:   13.45  
         cpu_system_pct:     20.37  
         cpu_user_pct:   66.18  
         forks:  13292498   
         instance_guid:  XXXXX  
         mem:    11910.879  
         mem_used:   10249.320
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@stanwin,

Hostwide component shows the operating system resource usage for the entire host (i.e., all system and user processes).
You might need to look at the system for resource utilization of individual process to see what's contributing to this overall host utilization using top or similar commands.

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@stanwin,

Hostwide component shows the operating system resource usage for the entire host (i.e., all system and user processes).
You might need to look at the system for resource utilization of individual process to see what's contributing to this overall host utilization using top or similar commands.

View solution in original post

0 Karma

stanwin
Contributor

thanks Renjith!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!