Monitoring Splunk Enterprise

Resource usage: Instance

This topic is a reference for the Resource usage: Instance dashboard in the distributed management console. See “About the distributed management console.”

What does this view show?

Several panels about resource usage, scoped by Splunk Enterprise instance.

Interpret results in this view

In the two "process class" panels, process class can be splunkd server, search, Splunk Web, index service, scripted input, KVStore, or other.

Process class means an aggregate of processes within one class. For more information about

• splunkd, read "Splunk Enterprise architecture and processes" in the Installation Manual.
• search, read "Get started with Search" and "Write better searches" in the Search Manual.
• splunkweb, read "Splunk Enterprise architecture and processes" in the Installation Manual.
• scripted input, read "Get data from APIs and other remote data interfaces through scripted inputs" in the Getting Data In Manual.
• KVStore, see the "KV store: Instance" view in DMC.

Index service consists of housekeeping tasks related to indexing. They run at the end of the indexing pipeline but are asynchronous. These processes run on their own, not through splunkd.

The Disk Usage and Median Disk Usage panels list only the partitions that Splunk Enterprise uses.

What to look out for in this view

If a process class that is using a lot of resources turns out to be search, go to the Search activity: Instance dashboard.

For long-running processes, a worrying thing to look out for is memory usage continuously increasing over time.

Troubleshoot this view

The historical panels get data from introspection logs. If a panel is blank or missing information from non-indexers, check:

• that you are forwarding your introspection logs to your indexers, and
• the system requirements for platform instrumentation.