Monitoring Splunk

Splunk resource usage by users/searches

jpillai
Path Finder

Hi all,

We are seeing a scenario where there are a lot of unoptimised searches, dashboards etc which when run are exhausting our CPU on indexers. If some users run resource intensive adhoc searches/dashboards etc simultaneously, this is becoming a problem as so many searches running together resulting in 'server busy' error at indexer.

 

1. Is there any way we can throttle CPU/memory usage per user/role/searches?

2. Are there any documents on optimising searches for better performance and less resource usage?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

1. Check out the Workload Management feature.  https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/Admin/WorkloadManagement

2. That's about as much art as it is science.  The Search Manual has a chapter on it that should get you started.  https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutoptimization

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...