https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47858#M561 <P>Clustering is not expected to use 20GB of RAM. In our tests we have not seen it go over 3GB. So, I would think that there is a associated memory leak. Which version of splunk is it? Please file a support case and we will help find the leak.</P> Fri, 04 Oct 2013 20:49:04 GMT jkerai 2013-10-04T20:49:04Z https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47853#M556 <P>Hi, </P> <P>Splunkd process running on the indexers in using more RAM memory .<BR /><BR /> With in last 7 days it has increased the usage from 9.8% to 70% on 20 GB RAM. It is killing the Splunk process after reaching the max. I'm using 5.0.2 Splunk on a linux VM. I'm using a nix app <BR /> and the memory by process is this <BR /> Resident_MB Virtual_MB Percentage Memory<BR /> splunkd 13379.101562 14352.585938 66.6</P> <P>How to solve the issue ? </P> Mon, 28 Sep 2020 14:39:45 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47853#M556 ssankeneni 2020-09-28T14:39:45Z https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47854#M557 <UL> <LI>Did it started after you configured clustering ? (if yes, how many indexers do you have, what is your replication factor and your search factor)</LI> <LI>do you have index time anonymization (sedcmd), or or index time filters using expensive Regexes ?</LI> </UL> Tue, 27 Aug 2013 14:27:17 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47854#M557 yannK 2013-08-27T14:27:17Z https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47855#M558 <P>Yes, This has started after enabling the clustering. I don't have any index time anonymization or index time filtering.</P> Tue, 27 Aug 2013 14:51:55 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47855#M558 ssankeneni 2013-08-27T14:51:55Z https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47856#M559 <P>Clustering is expensive :<BR /> - multiple all the disk space requirements by the replication factor.<BR /> - more network traffic<BR /> - more disk i/o<BR /> - more processing of the copies of the replicated buckets.</P> <P>And it also can be resource intensive, if all the events have to be parsed twice at index time ( if you required multiple copies of the buckets to be searchable with a search factor &gt; 1 ).</P> Tue, 27 Aug 2013 15:01:22 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47856#M559 yannK 2013-08-27T15:01:22Z https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47857#M560 <P>I'm aware of this but I thought splunk supports this.</P> Tue, 27 Aug 2013 15:47:48 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47857#M560 ssankeneni 2013-08-27T15:47:48Z https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47858#M561 <P>Clustering is not expected to use 20GB of RAM. In our tests we have not seen it go over 3GB. So, I would think that there is a associated memory leak. Which version of splunk is it? Please file a support case and we will help find the leak.</P> Fri, 04 Oct 2013 20:49:04 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunkd-process-on-the-indexer-in-clustering-using-too-much-RAM/m-p/47858#M561 jkerai 2013-10-04T20:49:04Z