topic Re: Splunk forwarder Powershell script is causing resource exhaustion in Splunk Enterprise

Splunk forwarder Powershell script is causing resource exhaustion

Roy_9 — Fri, 02 Feb 2024 15:26:33 GMT

Hello,

Splunk forwarder powershell script is causing resource exhaustion and this script is running for 8-9 hours.

Any idea on this issue?

Thanks

Re: Splunk forwarder Powershell script is causing resource exhaustion

Roy_9 — Fri, 02 Feb 2024 20:24:11 GMT

@gcusello do you have any idea on troubleshooting this issue?

Re: Splunk forwarder Powershell script is causing resource exhaustion

gcusello — Sat, 03 Feb 2024 06:38:55 GMT

Hi @Roy_9,

I suppose it's a script from an add-on, which one?

If it's a Splunk supported Add-On, you can open a case to Splunk Support.

Are you sure that the issue is in the script, what does it happen if you disable it?

Ciao.

Giuseppe

Re: Splunk forwarder Powershell script is causing resource exhaustion

Roy_9 — Sat, 03 Feb 2024 23:05:13 GMT

@gcusello It came with splunk forwarder package.

"C:\ProgramFiles\SplunkUniversalForwarder\bin\splunk-powershell.ps1

Thanks

Re: Splunk forwarder Powershell script is causing resource exhaustion

gcusello — Sun, 04 Feb 2024 06:32:55 GMT

Hi @Roy_9 ,

if it's a script from the Universal Forwarder, you can open a case to Splunk Support.

Some yers ago I had an issue with the UF installed on a server that wasn't able to connect to DNS server and used too much memory to resolve addresses, and Support solved the issue,

call them.

Ciao.

Giuseppe