Resources used by each saved search

[splunkrocks2014]

Hi. I wanted to find out if Splunk is able to show the CPU and memory usages from each savedsearch.

Thanks.

[cmerriman · Accepted solution]

you might want to tweak this a bit but i saw that the _introspection index had some data surrounding cpu and memory.

index="_introspection"  data.search_props.provenance="scheduler"  |bucket _time span=15m | stats max(data.pct_cpu) as pct_cpu max(data.normalized_pct_cpu) as normalized_pct_cpu max(data.mem_used) as mem_used by data.search_props.label _time

[splunkrocks2014]

Hi cmerriman, this is what I am looking for. I think pct_cpu means "percentage of CPU", but there is some data showing the pct_cpu is greater than 100. Any clues? Thanks.

[cmerriman]

this is what i found:

pct_cpu: Percentage of CPU usage, relative to one core. 100% is equivalent to 1 core
normalized_pct_cpu: Percentage of CPU usage across all cores. 100% is equivalent to all CPU resources on the machine.

http://docs.splunk.com/Documentation/Splunk/6.6.0/RESTREF/RESTintrospect#server.2Fstatus.2Fresource-...

[gcusello]

Hi splunkrocks2014,
using Distributed Monitoring Console at [Search -- Activity -- Search Activity: Instance] you have memory usage and response time, not CPU.
Bye.
Giuseppe