Getting Data In

vSphere Client Splunk VM using high Host Memory

wuming79
Path Finder

Hi,

I noticed my splunk vm is eating up a lot of host memory. I'm starting from 1GB to 2GB and now 8GB and it is always at full bar. What can I do to reduce the host memory usage? Is this due to too many data indexed?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Are you aware of the requirements to run a Splunk indexer on VMWare?
Splunk has pretty significant resource requirements for indexers to begin with and adhering to the best practices for virtualized indexers outlined in the document linked above is pretty much the only path to happiness.

There are a lot of things an indexer needs memory for. The indexing pipeline is one of them, but indexers are also handling search requests from the search heads. Things like large lookup files can increase your memory footprint.

As long as you don't experience symptoms of a memory leak, where RAM usage is increasing until the VM fails, anything between 1 and16GB is pretty normal for a busy indexer.

View solution in original post

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Are you aware of the requirements to run a Splunk indexer on VMWare?
Splunk has pretty significant resource requirements for indexers to begin with and adhering to the best practices for virtualized indexers outlined in the document linked above is pretty much the only path to happiness.

There are a lot of things an indexer needs memory for. The indexing pipeline is one of them, but indexers are also handling search requests from the search heads. Things like large lookup files can increase your memory footprint.

As long as you don't experience symptoms of a memory leak, where RAM usage is increasing until the VM fails, anything between 1 and16GB is pretty normal for a busy indexer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...