Splunk search for Memory used by search ID
Copy
index="_introspection" "data.process"=splunkd | timechart max(data.mem_used) as "Memory Used" by data.search_props.sid usenull=f useother=f
This Splunk search will show how much memory has been used by each search. The search will separate memory usage by search id.
0 comments
[0]
[0]
[0]
[0]
Sign in or Register to submit a comment