Deployment Architecture

Does increase in TCPOutput Queue cause forwarder to use more memory

Contributor

We came across an issue this past weekend where the UF on a Windows Server was utilizing high memory usage and when we dug deep, we identified the cause to be Splunk.

While expanding our investigation we can observe the host impacted have a good amount of data waiting.

is this possible that the memory usage was high because of this ?

0 Karma
1 Solution

Influencer

Yes. Splunk queues in memory by default. You can lower the queue size and use persistent queueing to write to disk instead, which will conserve memory.

View solution in original post

Influencer

Yes. Splunk queues in memory by default. You can lower the queue size and use persistent queueing to write to disk instead, which will conserve memory.

View solution in original post