I admin a Splunk Enterprise instance for an isolated LAN that has 3 workstations and two DCs (1 is file server, 2 is Splunk indexer and search head | both 32 GB RAM). Every 7-10 days, the Splunk server starts to slow down and then I'm completely unable to sign-in. Have to do a hard restart and it works fine again. Rinse and repeat.
I was glancing through the performance metrics on the "Monitoring Console" and saw a build up and spike of CPU and memory usage right before the freeze. The issue is that I cannot find any reason from Splunk as to why this is happening. The daily indexing rate over the last 30 days had a high of 1.3 GB with a max allowable of 5GB. I don't have any custom scheduled searches so maybe there's a default setting that is getting replicated?
If anyone has dealt with a similar issue I'd appreciate a suggestion.
Not sure if related: About a year ago we had big issues with indexing rates and event log duplication which caused us to exceed the license several times. We resolved that but this issue started around the same time.
