Splunk index server CPU exceeds 97 %. How can I toubleshoot

[msplunk33]

My indexer server CPU usage going more than 97%. How can I troubleshoot using Splunk query.

[isoutamo]

Try to put MC up to some node and use it. It’s much easier way to solve performance issues. https://docs.splunk.com/Documentation/Splunk/8.0.6/DMC/DMCoverview
You can get those queries from it or look those from web.
Another excellent tool on Linux command line is nmon. It gives your real-time picture what is happening on OS level.
https://sourceforge.net/projects/nmon/
r. Ismo

[gjanders]

Metricator for nmon on SplunkBase or splunk app for infrastructure will provide more detail on CPU then the monitoring console.

First start with the monitoring console then you could try alerts for splunk admins https://splunkbase.splunk.com/app/3796/

In particular the dashboards for resource usage by user will help if it's search related.