Top 20 Memory-Consuming Searches

[sbattista09]

in the Top 20 Memory-Consuming Searches dashboard in the DMC OR DM OR whatever its called nowadays i am seeing the user splunk-system-user running several searches named "N/A" in the app named Splunk_SA_CIM. Not sure what this is but some of the indexers are having CPU resource issues and i think this could be the issue. Any one have and insight as to what this would be or why its displaying N/A?

Thanks!

[rphillips_splk · Accepted solution]

Accelerating data models from the Splunk_SA_CIM app are known to be memory hogs if the data model root searches aren't scoped to specific indexes to search. By default they search index=*. Have a look at https://answers.splunk.com/answers/569469/why-is-there-excessive-memory-usage-on-indexers-af.html?ch...