We have few scheduled saved searches defined in our Splunk app "CCMS-TA-onprem-reporting".
One of the scheduled saved search "device_summary_index" - when it triggers - is continuously showing status as running and 2 cores of CPU are continuously taking 95% CPU usage.
After sometime, the Splunk UI becomes unresponsive.
Tried to restart splunk 2 times, but when the "device_summary_index" saved search runs again, same issue is observed.
Customer also tried to manually run the query of saved search "device_summary_index" from Search & Reporting app, but the Splunk UI stopped responding and I have to kill splunkd processes from backend.
↧
