Monitoring Splunk
Highlighted

Splunk high CPU utlization investigation

Splunk Employee
Splunk Employee

Is there a way to track a particular Splunk PID on the search head to see which search/action is being ran to track utilization?

0 Karma
Highlighted

Re: Splunk high CPU utlization investigation

Ultra Champion

Have you looked at the built-in statistics for this (in the Search App)? From the menu bar, choose;

Status -> Search Activity -> Search Activity Overview

Status -> Search Activity -> Search Detail

Could prove useful.

/K

0 Karma
Highlighted

Re: Splunk high CPU utlization investigation

Splunk Employee
Splunk Employee

Yeah I know about that but there are searches that are using a high amount of CPU and want to investigate who is running them and what they are doing. Is this logged in the _internal index? I know when you inspect a search it tells you the PID.

0 Karma
Highlighted

Re: Splunk high CPU utlization investigation

Splunk Employee
Splunk Employee

Have you tried to install the S.o.S app to see if it will help in providing more insight to your splunk instance?

http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk