Search activity: Deployment
What does this view show?
Several panels about search activity across your Splunk Enterprise deployment.
Interpret results in this view
The memory and CPU usage shown here are for searches only. See the resource usage dashboards for all Splunk Enterprise resource usage.
In the Instances by Median CPU Usage panel, CPU can be greater than 100% because of multiple cores.
In the Instances by Median Memory Usage panel, memory is physical.
For the modes historical batch and RT indexed: historical batch can be dispatched only by certain facilities within Splunk Enterprise (the scheduler, for example). RT indexed means indexed real-time.
What to look for in this view
Look for things that are close to exceeding their limits on your machines.
For more information, see:
- "Write better searches" in the Search Manual.
- "Get started with Search" in the Search Manual.
- "Configure the priority of scheduled reports" in the Reporting Manual.
- "Accommodate many simultaneous searches" in the Capacity Planning Manual.
Troubleshoot this view
The historical panels get data from introspection logs. If a panel is blank or missing information from non-indexers, check:
Search activity: Instance
Search usage statistics: Instance
This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15