Developing for Splunk Enterprise

hostwide component in resource_usage.log

stanwin
Contributor

What exactly is the hostwide component in below.

It is reporting the very high utilization of memory & subsequently the Splunkd process crashes.

The issue goes away on VM restart, but slowly hits saturation again in around a day..

Is it process in Splunk itself or is it a nix process.

It states: https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Whatdatagetslogged
host-level, dynamic CPU utilization and paging information.

Not much description here: https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTintrospect#server.2Fstatus.2Fresource...

index=_* host=ukwkmh-vmua084 source="/opt/splunk/var/log/introspection/resource_usage.log" sourcetype = splunk_resource_usage

{   [-] 
     component:  Hostwide   
     data:  {   [-] 
         cpu_arch:   x86_64 
         cpu_count:  12 
         cpu_idle_pct:   13.45  
         cpu_system_pct:     20.37  
         cpu_user_pct:   66.18  
         forks:  13292498   
         instance_guid:  XXXXX  
         mem:    11910.879  
         mem_used:   10249.320
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@stanwin,

Hostwide component shows the operating system resource usage for the entire host (i.e., all system and user processes).
You might need to look at the system for resource utilization of individual process to see what's contributing to this overall host utilization using top or similar commands.

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@stanwin,

Hostwide component shows the operating system resource usage for the entire host (i.e., all system and user processes).
You might need to look at the system for resource utilization of individual process to see what's contributing to this overall host utilization using top or similar commands.

View solution in original post

0 Karma

stanwin
Contributor

thanks Renjith!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!