Splunk Search

Checking mvexpand Memory Usage

alvin_sulendra
New Member

Hi All,
We are trying to get the memory usage of mvexpand command so that we can set the max_mem_usage_mb in the limits.conf correctly.

based the explanation in https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Limitsconf, mvexpand should truncate result when the memory limit is hit.

By using following search , I am able to get the search memory usage.

 

 

 

`dmc_set_index_introspection` host=SH1-stack360test01 sourcetype=splunk_resource_usage data.search_props.sid::* data.search_props.mode!=RT
        | `dmc_rename_introspection_fields`
        | stats max(elapsed) as runtime max(mem_used) as mem_used earliest(_time) as _time by sid, label, provenance, type, mode, app, role, search_head, user
        | eval mem_used = round(mem_used, 2)
        | sort 20 - mem_used
        | fields - day, hour, minute, second
        | eval _time = strftime(_time,"%+")
        | rename sid as SID, label as "Search Name", provenance AS Provenance, type as Type, mode as Mode, app as App, role as Role, search_head as "Search Head", user as User, mem_used as "Memory Usage (MB)", _time as Started, runtime as Runtime
        | fieldformat Runtime = `dmc_convert_runtime(Runtime)`

 

 

 

From the observation, mvexpand does not truncate the result when it is over the limit. (search memory usage hit 520 MB)
Limit is set as of following

 

 

 

[default]
max_mem_usage_mb = 512

[mvexpand]
max_mem_usage_mb = 512

 

 

 


Is there a way for us to get the memory usage by mvexpand command in a scheduled search? 

Thank you

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...