All Apps and Add-ons

Splunk App for Stream: Why are we seeing constant growth of memory usage by the streamfwd.exe process?

bpitts2
Path Finder

Hello all!

We've started to roll out the Splunk App for Stream to a few of our production servers. I've been watching the streamfwd.exe process' memory usage, and it just keeps growing. After leaving it run all night it was at 3.1GB this morning.

We're on Splunk 6.3 with the latest Splunk_TA_Stream (as far as I'm aware). We're only pulling SIP traffic.

I'll likely end up opening a support ticket, but wanted to ask here first if anyone else has seen this before.

Thanks!

vshcherbakov_sp
Splunk Employee
Splunk Employee

I'd recommend opening a support ticket since the issue will likely require some in-depth troubleshooting. Meanwhile, you can take a look at Network Metrics/Stream Forwarder Metrics/Stream Forwarder Log dashboards to see if there's anything suspicious there. I'd need to make sure the _internal index data from Splunk_TA_Stream host is available (i.e. _internal index is forwarded from UF running Splunk_TA_Stream) on the search head running Splunk App For Stream.

bpitts2
Path Finder

Will do, thanks!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...