Other Usage

How can I identify highest resource consumption alerts?

rahul_splunk
Loves-to-Learn Everything

Hi All,

I want to identify the alerts/usecases which are high in resources utilizing i.e., CPU consumption, RAM utilization etc.

 

BR,
RK

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Monitoring Console will tell you which searches use the most CPU.  Go to Resource Usage->CPU Usage: Instance then scroll down to the "Median CPU Usage of Searches" panel and change the 'Split by' setting to "Search Name".

I'm not aware of a way to find out how much memory searches use.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rahul_splunk
Loves-to-Learn Everything

@richgalloway Thanks for your response. But I wanted to monitor it for specific alerts.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Copy the MC search and modify it to suit your purposes.  You can copy an MC panel by clicking on the magnifying glass icon in the bottom-right corner of the panel.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That sounds like an interesting thing to do - what have you tried so far?

0 Karma

rahul_splunk
Loves-to-Learn Everything

Hi @ITWhisperer ,
I was looking on an alert to notify, if any host stops sending logs.
https://www.splunk.com/en_us/blog/tips-and-tricks/how-to-determine-when-a-host-stops-sending-logs-to...

It seems to be a complex query with combination of commands and function.

If we have some complex alerts like this in production environment, how our appliance gonna sustain?

So wanted to check a way, we can monitor resource when alert like this triggers!

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...