Splunk Search

How to search a list of saved searches that are (historically) consuming high CPU, memory, and take a long time to execute?

New Member

I want a search that will list saved searches that are (historically) consuming high CPU, memory, and take a long time to execute.

0 Karma
1 Solution

Builder

The Distributed Management Console has a dashboard for a similar search.

It's under the Search Menu -> Activitiy -> Search Usage Statistics : Deployment under the title "Long Running Searches"

Also, Search Menu -> Activity -> Search Activity : Deployment under the title "Top 20 Memory-Consuming Searches"

It has a bunch of other useful dashboards.

View solution in original post

Builder

The Distributed Management Console has a dashboard for a similar search.

It's under the Search Menu -> Activitiy -> Search Usage Statistics : Deployment under the title "Long Running Searches"

Also, Search Menu -> Activity -> Search Activity : Deployment under the title "Top 20 Memory-Consuming Searches"

It has a bunch of other useful dashboards.

View solution in original post

New Member

Thanks a lot sk314.It helped me,Now i need to find the cpu utilization for those searches too,any idea,how to append this query:

0 Karma

Builder

I am not sure if instrumentation at that resolution is possible/enabled.

0 Karma

New Member

I thought of taking the query by clicking "open in search" and appending it.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!