If your Splunk servers are not performing well, use the following solutions to identify a potential root cause of any high CPU and memory usage.
Check resource usage of instances
Make sure your Splunk instances are up to reference hardware recommendations. How well your searches are performing can also determine how well your instances are performing. If you are running bad searches, you will notice the CPU and memory usage of your Splunk indexers and search heads increase.
One way to check the resource usage of your Splunk instances is to use the Monitoring Console > Resource Usage > Resource Usage: Instance. On this dashboard, you can see how much CPU and memory each of your Splunk instances are using.
Check Python script usage
Another factor that plays into high CPU and memory usage could be the use of Python scripts on your Splunk boxes. There are many Splunk Technical Add-ons that have Python scripts embedded in the app. If you think this could be the cause of your problems, check on your server to see what processes are using up the most CPU and memory.
Check for inappropriately accelerated data models
High CPU and memory usage can be caused by accelerated data models.
If you are using accelerated data models, make sure that appropriate data models are the only ones that are accelerated. If you have data models accelerated that are not being used, Splunk Enterprise will still go through the process of trying and complete the data model, using up CPU and memory. Because of this, you should disable and decelerate the data models you are not using.
To decelerate or permanently disable data models, go to Settings > Data Inputs > Data Model Acceleration Enforcement.
These resources might help you understand and implement this guidance:
- Tekstream blog: Share and share alike: Using a data model job server for shared data model accelerations
Want to learn more about troubleshooting high resource usage? Contact us today! TekStream accelerates clients’ digital transformation by navigating complex technology environments with a combination of technical expertise and staffing solutions. We guide clients’ decisions, quickly implement the right technologies with the right people, and keep them running for sustainable growth. Our battle-tested processes and methodology help companies with legacy systems get to the cloud faster, so they can be agile, reduce costs, and improve operational efficiencies. And with hundreds of deployments under our belt, we can guarantee on-time and on-budget project delivery. That’s why 97% of clients are repeat customers.