Deployment Architecture

Does increase in TCPOutput Queue cause forwarder to use more memory

vr2312
Contributor

We came across an issue this past weekend where the UF on a Windows Server was utilizing high memory usage and when we dug deep, we identified the cause to be Splunk.

While expanding our investigation we can observe the host impacted have a good amount of data waiting.

is this possible that the memory usage was high because of this ?

0 Karma
1 Solution

masonmorales
Influencer

Yes. Splunk queues in memory by default. You can lower the queue size and use persistent queueing to write to disk instead, which will conserve memory.

View solution in original post

masonmorales
Influencer

Yes. Splunk queues in memory by default. You can lower the queue size and use persistent queueing to write to disk instead, which will conserve memory.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!