Splunk Search

How to search a list of saved searches that are (historically) consuming high CPU, memory, and take a long time to execute?

josf999
New Member

I want a search that will list saved searches that are (historically) consuming high CPU, memory, and take a long time to execute.

0 Karma
1 Solution

sk314
Builder

The Distributed Management Console has a dashboard for a similar search.

It's under the Search Menu -> Activitiy -> Search Usage Statistics : Deployment under the title "Long Running Searches"

Also, Search Menu -> Activity -> Search Activity : Deployment under the title "Top 20 Memory-Consuming Searches"

It has a bunch of other useful dashboards.

View solution in original post

sk314
Builder

The Distributed Management Console has a dashboard for a similar search.

It's under the Search Menu -> Activitiy -> Search Usage Statistics : Deployment under the title "Long Running Searches"

Also, Search Menu -> Activity -> Search Activity : Deployment under the title "Top 20 Memory-Consuming Searches"

It has a bunch of other useful dashboards.

View solution in original post

josf999
New Member

Thanks a lot sk314.It helped me,Now i need to find the cpu utilization for those searches too,any idea,how to append this query:

0 Karma

sk314
Builder

I am not sure if instrumentation at that resolution is possible/enabled.

0 Karma

josf999
New Member

I thought of taking the query by clicking "open in search" and appending it.

0 Karma