Hi All,
We are trying to get the memory usage of mvexpand command so that we can set the max_mem_usage_mb in the limits.conf correctly.
based the explanation in https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Limitsconf, mvexpand should truncate result when the memory limit is hit.
By using following search , I am able to get the search memory usage.
`dmc_set_index_introspection` host=SH1-stack360test01 sourcetype=splunk_resource_usage data.search_props.sid::* data.search_props.mode!=RT
| `dmc_rename_introspection_fields`
| stats max(elapsed) as runtime max(mem_used) as mem_used earliest(_time) as _time by sid, label, provenance, type, mode, app, role, search_head, user
| eval mem_used = round(mem_used, 2)
| sort 20 - mem_used
| fields - day, hour, minute, second
| eval _time = strftime(_time,"%+")
| rename sid as SID, label as "Search Name", provenance AS Provenance, type as Type, mode as Mode, app as App, role as Role, search_head as "Search Head", user as User, mem_used as "Memory Usage (MB)", _time as Started, runtime as Runtime
| fieldformat Runtime = `dmc_convert_runtime(Runtime)`
From the observation, mvexpand does not truncate the result when it is over the limit. (search memory usage hit 520 MB)
Limit is set as of following
[default]
max_mem_usage_mb = 512
[mvexpand]
max_mem_usage_mb = 512
Is there a way for us to get the memory usage by mvexpand command in a scheduled search?
Thank you
