All Apps and Add-ons

Why is the Splunk Add-on for Unix and Linux consuming all memory on my Windows indexers?


When I run this search on my search head:

earliest=-24h index=os sourcetype=ps tag=uat COMMAND=httpd|dedup PID | timechart span=1h count by host

The resulting search causes my indexers to go from 1.2G of ram to 12.0G of ram (how much memory they have) and cause all kind of faults. Errors talking to license server, completing search, etc., etc., to the point of making any other search, scheduled or ad-hoc, fail as well. I have two indexers and am only ingesting OS data from about 50 unix/Linux hosts currently.

Has anyone else seen anything like this?

0 Karma

Splunk Employee
Splunk Employee

I think you're hitting a Splunkd bug that causes over-aggressive expansion. Click "Inspect Search" and look at the normalized search; if it's expanding into all sorts of unexpected sourcetypes, you should probably upgrade to the latest Splunk.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...