How to Add RAM capacity Size to Splunk

wahluf — Mon, 23 Nov 2020 07:54:35 GMT

I processed 100 million events. from the data I use to present several kinds of visualization. but this makes memory limited so that an error appears like the following

Dag Execution Exception: Search has been cancelled. Search auto-canceled.

Re: How to Add RAM capacity Size to Splunk

nwuest — Mon, 23 Nov 2020 08:32:32 GMT

Hi @wahluf,

You are correct that you need to add RAM to your Splunk Searchhead to improve your search capabilities and performance.
See here: Searches are auto-cancelled

Do you happen to know if your Searchhead is a physical server or a virtual machine?

If it is a physical server, you will have to do some homework in finding what ram is currently installed on your server and if there are slots for expansion. Also, if your server has two cpu's you will need to buy equal ram modules for each processor otherwise they won't be recognized as part of a memory imbalance between the CPU's.
If it is a virtual machine, find out if you have additional resources to allocate to the Searchhead.
* NOTE: Work with the necessary parties to ensure that you are able to take what you can.

1. To add ram you will need to "configure" the VM and sometimes this will require that you have to turn off the VM to be able to add/change the resources for that VM.

2. Once the VM is off, you should be able to add the newly allocated RAM to the VM and then save the changes.

3. Now you can turn back on the VM, do ensure that the Splunk Service comes back up and the web page is accessible.
* NOTE: If you do have to turn off the Searchhead VM, do let the responsible parties/persons that use the Searchhead of its upcoming maintenance. It will save you a headache and phones calls asking why the server went down.

4. Depending on if you are able to "hot-add" RAM to the Searchhead VM or not, some good housekeeping would be to restart the guest OS which in turn would restart the Splunk Service. This will ensure that Splunk recognizes the newly added RAM and will be able to use it going forward in a clean manner.
See Here: Hot-add RAM to a Splunk Searchhead

We do hope this helps you out with your question!

V/R,
nwuest

Re: How to Add RAM capacity Size to Splunk

thambisetty — Mon, 23 Nov 2020 08:32:39 GMT

if you think you have enough memory then the issue could be with search you are running. there could be chance of improving search performance as well.

Re: How to Add RAM capacity Size to Splunk

inventsekar — Mon, 23 Nov 2020 08:49:14 GMT

Hi @wahluf if you update us your search query, then, we can fine-tune it. so that, the error may go away.

otherwise, you will need to add Ram as you said.

Adding RAM is simply the linux admin task. @nwuest 's reply got some nice details as well.

topic Re: How to Add RAM capacity Size to Splunk in Dashboards & Visualizations

How to Add RAM capacity Size to Splunk

Re: How to Add RAM capacity Size to Splunk

Re: How to Add RAM capacity Size to Splunk

Re: How to Add RAM capacity Size to Splunk