Monitoring Splunk

Splunk high CPU utlization investigation

aaronkorn
Splunk Employee
Splunk Employee

Is there a way to track a particular Splunk PID on the search head to see which search/action is being ran to track utilization?

0 Karma

splunkIT
Splunk Employee
Splunk Employee

Have you tried to install the S.o.S app to see if it will help in providing more insight to your splunk instance?

http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk

kristian_kolb
Ultra Champion

Have you looked at the built-in statistics for this (in the Search App)? From the menu bar, choose;

Status -> Search Activity -> Search Activity Overview

Status -> Search Activity -> Search Detail

Could prove useful.

/K

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Yeah I know about that but there are searches that are using a high amount of CPU and want to investigate who is running them and what they are doing. Is this logged in the _internal index? I know when you inspect a search it tells you the PID.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...