Is there a way to track a particular Splunk PID on the search head to see which search/action is being ran to track utilization?
Have you tried to install the S.o.S app to see if it will help in providing more insight to your splunk instance?
http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk
Have you looked at the built-in statistics for this (in the Search App)? From the menu bar, choose;
Status -> Search Activity -> Search Activity Overview
Status -> Search Activity -> Search Detail
Could prove useful.
/K
Yeah I know about that but there are searches that are using a high amount of CPU and want to investigate who is running them and what they are doing. Is this logged in the _internal index? I know when you inspect a search it tells you the PID.