splunk process occuoying too much memory in solaris servers

[sarnagar]

Hi All,

I have SPlunk forwarder installed on solaris servers and this seems to be occupying memory offlate. What could be the reason for this? N how to overcome this?
It occupies more than 500MB..

[alacercogitatus]

Check the number of open files. If Splunk is monitoring a large amount of individual files, the memory usage could expand drastically.

First, find the pid of the main Splunk process. Normally this is done with a ps -ef | grep splunk. Then take that pid and put it into this command: lsof -p | wc -l. This will count the number of open files for the forwarder. This number might be very high. If it is not very high (let's say < 10K), you may have other issues in play.

What version of Splunk forwarder? What version of Solaris?

[sarnagar]

Hi,
Thakyou for the response.
Actually I'm not able to run the lsof command on the solaris server. I Get the below error:

lsof -p 5523 |wc -l

lsof: FATAL: lsof was compiled for a 32 bit kernel,
but this machine has booted a 64 bit kernel.
0
I have splunk UF version as:

/opt/splunkforwarder/bin/splunk version

Splunk Universal Forwarder 6.1.4 (build 233537)

Solaris version:

uname -a

SunOS ss73fmoapq230 5.10 Generic_150401-23 i86pc i386 i86pc