@splukiee
Certainly! Addressing high CPU usage in your Splunk environment due to specific dashboards can be challenging, but let’s explore some strategies to mitigate the issue:
Dashboard Optimization:-
Review Dashboard Components:
Inspect each dashboard panel. Are there any resource-intensive visualizations (e.g., complex charts, tables, or maps)? Simplify or optimize them.
Reduce Real-Time Updates:
If dashboards update in real-time, consider increasing the refresh interval. Frequent updates can strain CPU resources.
Limit Concurrent Sessions:
Since users have multiple sessions open, limit the number of concurrent sessions per user. Excessive sessions can overload the system.
Use Summary Indexes:
Consider using summary indexes for frequently accessed data. This reduces the need for real-time searches.
Monitoring and Troubleshooting:
Splunk Monitoring Console (MC): Use MC to monitor resource usage. Check the CPU Usage by process class graph to identify which components consume the most CPU.
https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Troubleshooting_high_resource...
https://docs.splunk.com/Documentation/Splunk/9.2.0/DMC/ResourceusageCPU
