We came across an issue this past weekend where the UF on a Windows Server was utilizing high memory usage and when we dug deep, we identified the cause to be Splunk.
While expanding our investigation we can observe the host impacted have a good amount of data waiting.
is this possible that the memory usage was high because of this ?
Yes. Splunk queues in memory by default. You can lower the queue size and use persistent queueing to write to disk instead, which will conserve memory.
Yes. Splunk queues in memory by default. You can lower the queue size and use persistent queueing to write to disk instead, which will conserve memory.