Regex Processor CPU Profiling per Sourcetype” under "DMC -> Indexing -> Indexing Performance:Instances" is not populating any data.

[khusain_splunk]

Regex Processor CPU Profiling per Sourcetype” under "DMC -> Indexing -> Indexing Performance:Instances" is not populating any data.

[mbagali_splunk · Accepted solution]

“Regex Processor CPU Profiling per Sourcetype” is a new splunk feature and by default this panel do not populate any data.

To load the panel we need to set "regex_cpu_profiling = true" in limits.conf file. By default it is set to false.

regex_cpu_profiling =

* Enable CPU time metrics for RegexProcessor. Output will be in the
metrics.log file.
Entries in metrics.log will appear per_host_regex_cpu, per_source_regex_cpu,
per_sourcetype_regex_cpu, per_index_regex_cpu.
* Default: false

"regex_cpu_profiling" is utilized as a troubleshooting tool to identify blocks in the typing queue and narrowing down which source and/or source type is taking most of the CPU time or the CPU time per event.

If you are interested in the per_host_regex_cpu it would be necessary to enable the regex_cpu_profiling = true on all of the "Indexers" so you can receive these type of metrics logs from all the indexers.

We recommend you compare splunkd CPU utilization before & after turning it on.

[gjanders]

This does not appear to be well documented but I believe you can enable it in the limits.conf file:

regex_cpu_profiling = <bool>
* Enable CPU time metrics for RegexProcessor. Output will be in the 
  metrics.log file.
  Entries in metrics.log will appear per_host_regex_cpu, per_source_regex_cpu,
  per_sourcetype_regex_cpu, per_index_regex_cpu.
* Default: false

The help page for the monitoring console goes here but no mention of the above setting...