Splunk Search

How can I know if my heavy forwarder is processing the regex? Bonus: How can I check the memory and CPU consumption?

kteng2024
Path Finder

Hi ,

I installed a heavy forwarder for regex processing a few source types, not for indexing. How can I know whether the heavy forwarder is processing the regex? How can I check the memory consumption and CPU consumption from the search head or DMC (heavy forwarder is connected to DMC)?

0 Karma

sbbadri
Motivator

Regex processing:

1) If regex is correct , you should see extracted field in interesting fields for that sourcetype by using spl query.
2) from GUI, settings->fields-> field extractions-> search for sourcetype or field name. it should fetch some results

CPU and Memory:

1) Install Splunk_TA_nix splunk Addon. So it will report cpu, memory and other os related stats.
2) Settings->Montoring Console-> Resource Usage-> Resource usage:Instances-> select the instance - for this you need setup montoring console

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...