measuring search load on indexers

[esalesapns2]

Our indexers are reporting “server-busy” errors back to the kinesis data firehoses periodically.

This is an indication that the indexers’ ingest queues are full, which can be caused by high

Ingest rates and system utilization.  Since searches contribute to system utilization, are there

ways of measuring the load induced by the searches versus the ingest processing?

[esalesapns2]

thanks, Rich, we're ingest-licensed, alas

[richgalloway]

If you have a workload license, the Monitoring Console should have that information.  AFAIK, it's not available for ingest-licensed systems.

[esalesapns2]

The Resource Usage: Instance panel of the Monitoring console splits out Physical Memory and CPU Usage by Process Class.  Classes include: "index service", "other", "scripted input", "search", and "splunkd_server".  This helped somewhat.