All Apps and Add-ons

Why is the Splunk Add-on for Unix and Linux consuming all memory on my Windows indexers?

tyronetv
Communicator

When I run this search on my search head:

earliest=-24h index=os sourcetype=ps tag=uat COMMAND=httpd|dedup PID | timechart span=1h count by host

The resulting search causes my indexers to go from 1.2G of ram to 12.0G of ram (how much memory they have) and cause all kind of faults. Errors talking to license server, completing search, etc., etc., to the point of making any other search, scheduled or ad-hoc, fail as well. I have two indexers and am only ingesting OS data from about 50 unix/Linux hosts currently.

Has anyone else seen anything like this?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

I think you're hitting a Splunkd bug that causes over-aggressive expansion. Click "Inspect Search" and look at the normalized search; if it's expanding into all sorts of unexpected sourcetypes, you should probably upgrade to the latest Splunk.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...