Delete busy jobs in the cli

[chris]

Hi

We recently had the situation, where the web interface was responding slowly and we had a high load on the system caused by splunk processes.

The following message was in splunkd.log:

WARN  DispatchCommand - The system is approaching the maximum number of historical searches that can be run concurrently. current=55 maximum=68  

We think this could be because the searches running concurrently cause the high load.

Is there a way to use the CLI to display how resource intensive jobs/searches are that are currently running and is there a way to kill/cancel/delete resource intensive jobs?

Thanks

Chris

[Dark_Ichigo · Accepted solution]

To search for the Current jobs:

ps -ef | grep "splunkd search"

http://www.splunk.com/base/Documentation/latest/Admin/ManagejobsintheOS

To terminate, just kill the proccess ID

[Dark_Ichigo]

No worries 🙂

[chris]

Thanks, it's: ps -ef | grep "splunkd search" can you change that in the response and I'll accept it.