Does increase in TCPOutput Queue cause forwarder to use more memory

[vr2312]

We came across an issue this past weekend where the UF on a Windows Server was utilizing high memory usage and when we dug deep, we identified the cause to be Splunk.

While expanding our investigation we can observe the host impacted have a good amount of data waiting.

is this possible that the memory usage was high because of this ?

[masonmorales · Accepted solution]

Yes. Splunk queues in memory by default. You can lower the queue size and use persistent queueing to write to disk instead, which will conserve memory.