Splunk Enterprise Security

Top 20 Memory-Consuming Searches

sbattista09
Contributor

in the Top 20 Memory-Consuming Searches dashboard in the DMC OR DM OR whatever its called nowadays i am seeing the user splunk-system-user running several searches named "N/A" in the app named Splunk_SA_CIM. Not sure what this is but some of the indexers are having CPU resource issues and i think this could be the issue. Any one have and insight as to what this would be or why its displaying N/A?

Thanks!

0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

Accelerating data models from the Splunk_SA_CIM app are known to be memory hogs if the data model root searches aren't scoped to specific indexes to search. By default they search index=*. Have a look at https://answers.splunk.com/answers/569469/why-is-there-excessive-memory-usage-on-indexers-af.html?ch...

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

Accelerating data models from the Splunk_SA_CIM app are known to be memory hogs if the data model root searches aren't scoped to specific indexes to search. By default they search index=*. Have a look at https://answers.splunk.com/answers/569469/why-is-there-excessive-memory-usage-on-indexers-af.html?ch...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...