Getting Data In

Why would indexers in our indexer cluster suddenly start consuming 100% CPU?

Explorer

We have an indexer clustering Splunk environment, and recently, all our indexers are consuming 100% CPU. Not sure what will be the issue.

Kindly suggest

0 Karma

Esteemed Legend

Are you using Real-Time searches? This will totally lock 1 core on every server.
Have you recently started Accelerating searches? The Indexer CPU cost can add up very quickly and has a temporary "backfill" cost that is very noticeable.

Revered Legend
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!