Skip to main content
Lantern Home
 
 
Splunk Lantern

Troubleshooting high resource usage in Splunk Enterprise

  1. Last updated
  2. Save as PDF

 

If your Splunk servers are not performing well, use the following solutions to identify a potential root cause of any high CPU and memory usage.

Check resource usage of instances

Make sure your Splunk instances are up to reference hardware recommendations. How well your searches are performing can also determine how well your instances are performing. If you are running bad searches, you will notice the CPU and memory usage of your Splunk indexers and search heads increase.

One way to check the resource usage of your Splunk instances is to use the Monitoring Console > Resource Usage > Resource Usage: Instance. On this dashboard, you can see how much CPU and memory each of your Splunk instances are using.

Check Python script usage

Another factor that plays into high CPU and memory usage could be the use of Python scripts on your Splunk boxes. There are many Splunk technical add-ons that have Python scripts embedded in the app. If you think this could be the cause of your problems, check on your server to see what processes are using up the most CPU and memory.

Check for inappropriately accelerated data models

High CPU and memory usage can be caused by accelerated data models.

If you are using accelerated data models, make sure that appropriate data models are the only ones that are accelerated. If you have data models accelerated that are not being used, Splunk Enterprise will still go through the process of trying and complete the data model, using up CPU and memory. Because of this, you should disable and decelerate the data models you are not using.

To decelerate or permanently disable data models, go to Settings > Data Inputs > Data Model Acceleration Enforcement.

TS_Blog_3-Most-Common-Splunk-Issues-image-4.webp

Next steps

These resources might help you understand and implement this guidance:

Want to learn more about troubleshooting high resource usage? Contact us today! TekStream accelerates clients’ digital transformation by navigating complex technology environments with a combination of technical expertise and staffing solutions. We guide clients’ decisions, quickly implement the right technologies with the right people, and keep them running for sustainable growth. Our battle-tested processes and methodology help companies with legacy systems get to the cloud faster, so they can be agile, reduce costs, and improve operational efficiencies. And with hundreds of deployments under our belt, we can guarantee on-time and on-budget project delivery. That’s why 97% of clients are repeat customers.

The user- and community-generated information, content, data, text, graphics, images, videos, documents and other materials made available on Splunk Lantern is Community Content as provided in the terms and conditions of the Splunk Website Terms of Use, and it should not be implied that Splunk warrants, recommends, endorses or approves of any of the Community Content, nor is Splunk responsible for the availability or accuracy of such. Splunk specifically disclaims any liability and any actions resulting from your use of any information provided on Splunk Lantern.