How can I know if my heavy forwarder is processing the regex? Bonus: How can I check the memory and CPU consumption?

[kteng2024]

Hi ,

I installed a heavy forwarder for regex processing a few source types, not for indexing. How can I know whether the heavy forwarder is processing the regex? How can I check the memory consumption and CPU consumption from the search head or DMC (heavy forwarder is connected to DMC)?

[sbbadri]

Regex processing:

1) If regex is correct , you should see extracted field in interesting fields for that sourcetype by using spl query.
2) from GUI, settings->fields-> field extractions-> search for sourcetype or field name. it should fetch some results

CPU and Memory:

1) Install Splunk_TA_nix splunk Addon. So it will report cpu, memory and other os related stats.
2) Settings->Montoring Console-> Resource Usage-> Resource usage:Instances-> select the instance - for this you need setup montoring console