Splunk Search

Resources used by each saved search

splunkrocks2014
Communicator

Hi. I wanted to find out if Splunk is able to show the CPU and memory usages from each savedsearch.

Thanks.

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

you might want to tweak this a bit but i saw that the _introspection index had some data surrounding cpu and memory.

index="_introspection"  data.search_props.provenance="scheduler"  |bucket _time span=15m | stats max(data.pct_cpu) as pct_cpu max(data.normalized_pct_cpu) as normalized_pct_cpu max(data.mem_used) as mem_used by data.search_props.label _time

View solution in original post

cmerriman
Super Champion

you might want to tweak this a bit but i saw that the _introspection index had some data surrounding cpu and memory.

index="_introspection"  data.search_props.provenance="scheduler"  |bucket _time span=15m | stats max(data.pct_cpu) as pct_cpu max(data.normalized_pct_cpu) as normalized_pct_cpu max(data.mem_used) as mem_used by data.search_props.label _time

splunkrocks2014
Communicator

Hi cmerriman, this is what I am looking for. I think pct_cpu means "percentage of CPU", but there is some data showing the pct_cpu is greater than 100. Any clues? Thanks.

0 Karma

cmerriman
Super Champion

this is what i found:

pct_cpu: Percentage of CPU usage, relative to one core. 100% is equivalent to 1 core
normalized_pct_cpu: Percentage of CPU usage across all cores. 100% is equivalent to all CPU resources on the machine.

http://docs.splunk.com/Documentation/Splunk/6.6.0/RESTREF/RESTintrospect#server.2Fstatus.2Fresource-...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi splunkrocks2014,
using Distributed Monitoring Console at [Search -- Activity -- Search Activity: Instance] you have memory usage and response time, not CPU.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...