hostwide component in resource_usage.log

[stanwin]

What exactly is the hostwide component in below.

It is reporting the very high utilization of memory & subsequently the Splunkd process crashes.

The issue goes away on VM restart, but slowly hits saturation again in around a day..

Is it process in Splunk itself or is it a nix process.

It states: https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Whatdatagetslogged
host-level, dynamic CPU utilization and paging information.

Not much description here: https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTintrospect#server.2Fstatus.2Fresource...

index=_* host=ukwkmh-vmua084 source="/opt/splunk/var/log/introspection/resource_usage.log" sourcetype = splunk_resource_usage

{   [-] 
     component:  Hostwide   
     data:  {   [-] 
         cpu_arch:   x86_64 
         cpu_count:  12 
         cpu_idle_pct:   13.45  
         cpu_system_pct:     20.37  
         cpu_user_pct:   66.18  
         forks:  13292498   
         instance_guid:  XXXXX  
         mem:    11910.879  
         mem_used:   10249.320

[renjith_nair · Accepted solution]

@stanwin,

Hostwide component shows the operating system resource usage for the entire host (i.e., all system and user processes).
You might need to look at the system for resource utilization of individual process to see what's contributing to this overall host utilization using top or similar commands.

[stanwin]

thanks Renjith!