Monitoring Splunk

After installing Splunk 6.4.1, splunkd is consuming high CPU and memory. How do I reduce this usage?

s_mkonda
New Member

I am new to Splunk.

A week back, we have installed Splunk 6.4.1.
Now we see splunkd is consuming high CPU and memory, please help me to reduce swap usage

0 Karma

koshyk
Super Champion
  • Are you using SH cluster?
  • splunkd process in Indexer or SH, where are u finding high cpu?
  • Have you upgraded addons/apps?
0 Karma

shawngarrettsgp
Path Finder
  • No we are not using SHC yet in our multi-site deployment.
  • neither, this is on the Universal Forwarder side of a Windows client
  • In what context, recently since the issue occured? No, we updaded from 6.0.3 ->6.4.1 roughly ~7months ago or so. There has been various config changes from the UF side just some basic updates to Windows & Unix TA's.
0 Karma

skoelpin
SplunkTrust
SplunkTrust

I had the same issue using 6.4.1 forwarder except it was high CPU.. I opened a support case and they confirmed it was a bug in the 6.4.1 forwarder and recommended I use an older 6.3.6 forwarder

Case # 378231

tweaktubbie
Communicator

Same question on which reference, I noticed Linux 6.3.3 UF works fine but our Wintel 6.4.1 UF gives sometimes unbelievable CPU load on quiet test servers. And wondering to which 6.4.x or 6.5.x is now the best option.

shawngarrettsgp
Path Finder

Have a reference by chance to the known bug?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...