Resource usage: Instance
What does this view show?
Several panels about search activity.
Interpret results in this view
In the two "process class" panels, process class can be splunkd server, search, Splunk Web, index service, scripted input, KVStore, or other.
Process class means an aggregate of processes within one class. For more information about
- splunkd, read "Splunk Enterprise architecture and processes" in the Installation Manual.
- search, read "Get started with Search" and "Write better searches" in the Search Manual.
- splunkweb, read "Splunk Enterprise architecture and processes" in the Installation Manual.
- scripted input, read "Get data from APIs and other remote data interfaces through scripted inputs" in the Getting Data In Manual.
- KVStore, see the "KV store: Instance" view in DMC.
Index service consists of housekeeping tasks related to indexing. They run at the end of the indexing pipeline but are asynchronous. These processes run on their own, not through splunkd.
The Disk Usage and Median Disk Usage panels list only the partitions that Splunk Enterprise uses.
What to look out for in this view
If a process class that is using a lot of resources turns out to be search, go to the Search activity: Instance dashboard.
For long-running processes, a worrying thing to look out for is memory usage continuously increasing over time.
Troubleshoot this view
The historical panels get data from introspection logs. If a panel is blank or missing information from non-indexers, check:
Search usage statistics: Instance
Resource usage: Machine
This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14