The CPU usage chart in Settings > Monitoring Console seems to be a snapshot of the current searches' resource usage.
When I clicked the search part on the CPU usage pie chart, it directs me to the following search
| rest splunk_server=local /services/server/status/resource-usage/splunk-processes | eval sid = 'search_props.sid' | eval process_class = case( process=="splunk-optimize","index service", process=="sh" OR process=="ksh" OR process=="bash" OR like(process,"python%") OR process=="powershell","scripted input", process=="mongod", "KVStore") | eval process_class = case( process=="splunkd" AND (like(args,"-p %start%") OR like(args,"service")),"splunkd server", process=="splunkd" AND isnotnull(sid),"search", process=="splunkd" AND (like(args,"fsck%") OR like(args,"recover-metadata%") OR like(args,"cluster_thing")),"index service", process=="splunkd" AND args=="instrument-resource-usage", "scripted input", (like(process,"python%") AND like(args,"%/appserver/mrsparkle/root.py%")) OR like(process,"splunkweb"),"Splunk Web", isnotnull(process_class), process_class) | eval process_class = if(isnull(process_class),"other",process_class)| search process_class=search | eval x="cpu_usage"
I would like to see the top searches consuming CPU in the past range of time, e.g. in the last recent days.
I have checked out the Settings>Monitoring Console>Search Activity:Instance>Maximum Resource Usage of Searches. The search name which consumes over half of CPU cores is N/A. What does N/A mean here? How can I see the real search name?
... View more