https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-high-memory-usage-with-a-Splunk-6-2-3/m-p/269388#M51725 <P>The amount of memory that a Splunk forwarder uses is directly related to the number of files that the forwarder is monitoring.</P> <P>How many files is the forwarder monitoring? If you are not sure, log on the the machine and run</P> <PRE><CODE>splunk list monitor </CODE></PRE> <P>You may see that you are monitoring <EM>many</EM> files, including inactive files. The problem is that Splunk cannot be sure those files are inactive; it will continue to keep them in its list of files to monitor. If you can refine the stanzas in inputs.conf to monitor less - or remove the inactive files from the path that Splunk is monitoring - you will probably see an immediate reduction in the memory and CPU consumption. (You will have to restart the forwarder after making these changes.)</P> <P>Of course, this is just a guess, based on not much information...</P> Thu, 10 Dec 2015 20:23:18 GMT lguinn2 2015-12-10T20:23:18Z https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-high-memory-usage-with-a-Splunk-6-2-3/m-p/269387#M51724 <P>We are currently having an issue with Splunk forwarder installed on a Windows server. It takes up a lot of memory utilization. </P> <P>Any suggestion how to fix this? We are running Splunk 6.2.3. Help help. Thanks.</P> Thu, 10 Dec 2015 13:56:05 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-high-memory-usage-with-a-Splunk-6-2-3/m-p/269387#M51724 mattkun 2015-12-10T13:56:05Z https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-high-memory-usage-with-a-Splunk-6-2-3/m-p/269388#M51725 <P>The amount of memory that a Splunk forwarder uses is directly related to the number of files that the forwarder is monitoring.</P> <P>How many files is the forwarder monitoring? If you are not sure, log on the the machine and run</P> <PRE><CODE>splunk list monitor </CODE></PRE> <P>You may see that you are monitoring <EM>many</EM> files, including inactive files. The problem is that Splunk cannot be sure those files are inactive; it will continue to keep them in its list of files to monitor. If you can refine the stanzas in inputs.conf to monitor less - or remove the inactive files from the path that Splunk is monitoring - you will probably see an immediate reduction in the memory and CPU consumption. (You will have to restart the forwarder after making these changes.)</P> <P>Of course, this is just a guess, based on not much information...</P> Thu, 10 Dec 2015 20:23:18 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-we-seeing-high-memory-usage-with-a-Splunk-6-2-3/m-p/269388#M51725 lguinn2 2015-12-10T20:23:18Z