Hi. I wanted to find out if Splunk is able to show the CPU and memory usages from each savedsearch.
Thanks.
you might want to tweak this a bit but i saw that the _introspection index had some data surrounding cpu and memory.
index="_introspection" data.search_props.provenance="scheduler" |bucket _time span=15m | stats max(data.pct_cpu) as pct_cpu max(data.normalized_pct_cpu) as normalized_pct_cpu max(data.mem_used) as mem_used by data.search_props.label _time
you might want to tweak this a bit but i saw that the _introspection index had some data surrounding cpu and memory.
index="_introspection" data.search_props.provenance="scheduler" |bucket _time span=15m | stats max(data.pct_cpu) as pct_cpu max(data.normalized_pct_cpu) as normalized_pct_cpu max(data.mem_used) as mem_used by data.search_props.label _time
Hi cmerriman, this is what I am looking for. I think pct_cpu means "percentage of CPU", but there is some data showing the pct_cpu is greater than 100. Any clues? Thanks.
this is what i found:
pct_cpu: Percentage of CPU usage, relative to one core. 100% is equivalent to 1 core
normalized_pct_cpu: Percentage of CPU usage across all cores. 100% is equivalent to all CPU resources on the machine.
Hi splunkrocks2014,
using Distributed Monitoring Console at [Search -- Activity -- Search Activity: Instance] you have memory usage and response time, not CPU.
Bye.
Giuseppe