Monitoring Splunk

Splunk index server CPU exceeds 97 %. How can I toubleshoot

msplunk33
Path Finder

My indexer server CPU usage going more than 97%. How can I troubleshoot using Splunk query.

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Try to put MC up to some node and use it. It’s much easier way to solve performance issues. https://docs.splunk.com/Documentation/Splunk/8.0.6/DMC/DMCoverview
You can get those queries from it or look those from web.
Another excellent tool on Linux command line is nmon. It gives your real-time picture what is happening on OS level.
https://sourceforge.net/projects/nmon/
r. Ismo
0 Karma

gjanders
SplunkTrust
SplunkTrust

Metricator for nmon on SplunkBase or splunk app for infrastructure will provide more detail on CPU then the monitoring console.

First start with the monitoring console then you could try alerts for splunk admins https://splunkbase.splunk.com/app/3796/

 

In particular the dashboards for resource usage by user will help if it's search related.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...