- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to search a list of saved searches that are (h...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want a search that will list saved searches that are (historically) consuming high CPU, memory, and take a long time to execute.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Distributed Management Console has a dashboard for a similar search.
It's under the Search Menu -> Activitiy -> Search Usage Statistics : Deployment under the title "Long Running Searches"
Also, Search Menu -> Activity -> Search Activity : Deployment under the title "Top 20 Memory-Consuming Searches"
It has a bunch of other useful dashboards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Distributed Management Console has a dashboard for a similar search.
It's under the Search Menu -> Activitiy -> Search Usage Statistics : Deployment under the title "Long Running Searches"
Also, Search Menu -> Activity -> Search Activity : Deployment under the title "Top 20 Memory-Consuming Searches"
It has a bunch of other useful dashboards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks a lot sk314.It helped me,Now i need to find the cpu utilization for those searches too,any idea,how to append this query:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not sure if instrumentation at that resolution is possible/enabled.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I thought of taking the query by clicking "open in search" and appending it.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
