Monitoring Splunk
Highlighted

What could be the reason for a spike in CPU Usage in some indexers in a clustered environment?

Builder

Hi,

I have a clustered environment and it runs smoothly, but sometimes, I see a spike in CPU Usage in some of the indexers up to 70 or 80%.

what would be the reason ?

For what purpose does a Splunk indexer use CPU and what is the ideal CPU usage in an indexer ?

Thanks

0 Karma
Highlighted

Re: What could be the reason for a spike in CPU Usage in some indexers in a clustered environment?

SplunkTrust
SplunkTrust

Have you correlated the CPU spikes with other activity, like scheduled searches, data model accelerations, etc? Perhaps you have a particularly inefficient or wide-ranging search that is causing the CPU usage.

Indexers use CPU to index data and conduct searches.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: What could be the reason for a spike in CPU Usage in some indexers in a clustered environment?

Path Finder

we need to isolate the reason why this could happen in indexer.

Are you using VMs? If not, check disk health and IOPS, e.g. with Bonnie++

Go to your master and take a look at the DMC, specifically Indexing -> Performance -> Indexing Performance: Instance (select affected indexer)

https://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Troubleshootindexingperformance

Create a support ticket with splunk if the above doesn't help

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.