There isn't message of "linux transparent hugepage support" in splunkd.log of lately UF.

[yutaka1005]

I think that the messages below isn't appear in splunkd.log in UF lately.

INFO ulimit - Linux transparent hugepage support, enabled="never" defrag="never"

I can find it in splunk, but I can't in UF.

Is this a specification?
The THP setting itself is disabled regardless of the presence or absence of a message.

[gcusello · Accepted solution]

Hi yutaka1005,
as you can find in https://docs.splunk.com/Documentation/Splunk/7.0.2/ReleaseNotes/SplunkandTHP THP bring a "30% degradation in indexing and search performance", this means that THP is relevant on Search Head and Indexers, I never disabled THP on Universal Forwarders.

Anyway, if you run the Healt Check, that you can find in the Monitoring Console App (on Splunk Enterprise not on UFs), it shows the presence of enabled or disabled THP.

Bye.
Giuseppe

[yutaka1005]

Thank you for answer.

So,
you mean that this log is not displayed is a specification, and it is no problem, right?

[gcusello]

yes.
Bye.
Giuseppe