My indexer server CPU usage going more than 97%. How can I troubleshoot using Splunk query.
Metricator for nmon on SplunkBase or splunk app for infrastructure will provide more detail on CPU then the monitoring console.
First start with the monitoring console then you could try alerts for splunk admins https://splunkbase.splunk.com/app/3796/
In particular the dashboards for resource usage by user will help if it's search related.