Splunk Dev

hostwide component in resource_usage.log

stanwin
Contributor

What exactly is the hostwide component in below.

It is reporting the very high utilization of memory & subsequently the Splunkd process crashes.

The issue goes away on VM restart, but slowly hits saturation again in around a day..

Is it process in Splunk itself or is it a nix process.

It states: https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Whatdatagetslogged
host-level, dynamic CPU utilization and paging information.

Not much description here: https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTintrospect#server.2Fstatus.2Fresource...

index=_* host=ukwkmh-vmua084 source="/opt/splunk/var/log/introspection/resource_usage.log" sourcetype = splunk_resource_usage

{   [-] 
     component:  Hostwide   
     data:  {   [-] 
         cpu_arch:   x86_64 
         cpu_count:  12 
         cpu_idle_pct:   13.45  
         cpu_system_pct:     20.37  
         cpu_user_pct:   66.18  
         forks:  13292498   
         instance_guid:  XXXXX  
         mem:    11910.879  
         mem_used:   10249.320
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@stanwin,

Hostwide component shows the operating system resource usage for the entire host (i.e., all system and user processes).
You might need to look at the system for resource utilization of individual process to see what's contributing to this overall host utilization using top or similar commands.

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@stanwin,

Hostwide component shows the operating system resource usage for the entire host (i.e., all system and user processes).
You might need to look at the system for resource utilization of individual process to see what's contributing to this overall host utilization using top or similar commands.

Happy Splunking!
0 Karma

stanwin
Contributor

thanks Renjith!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...