We came across an issue this past weekend where the UF on a Windows Server was utilizing high memory usage and when we dug deep, we identified the cause to be Splunk.
While expanding our investigation we can observe the host impacted have a good amount of data waiting.
is this possible that the memory usage was high because of this ?
Yes. Splunk queues in memory by default. You can lower the queue size and use persistent queueing to write to disk instead, which will conserve memory.
View solution in original post