Splunk high CPU utlization investigation

[aaronkorn]

Is there a way to track a particular Splunk PID on the search head to see which search/action is being ran to track utilization?

[splunkIT]

Have you tried to install the S.o.S app to see if it will help in providing more insight to your splunk instance?

http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk

[kristian_kolb]

Have you looked at the built-in statistics for this (in the Search App)? From the menu bar, choose;

Status -> Search Activity -> Search Activity Overview

Status -> Search Activity -> Search Detail

Could prove useful.

/K

[aaronkorn]

Yeah I know about that but there are searches that are using a high amount of CPU and want to investigate who is running them and what they are doing. Is this logged in the _internal index? I know when you inspect a search it tells you the PID.