Getting Data In

There isn't message of "linux transparent hugepage support" in splunkd.log of lately UF.

Builder

I think that the messages below isn't appear in splunkd.log in UF lately.

INFO ulimit - Linux transparent hugepage support, enabled="never" defrag="never"

I can find it in splunk, but I can't in UF.

Is this a specification?
The THP setting itself is disabled regardless of the presence or absence of a message.

0 Karma
1 Solution

Legend

Hi yutaka1005,
as you can find in https://docs.splunk.com/Documentation/Splunk/7.0.2/ReleaseNotes/SplunkandTHP THP bring a "30% degradation in indexing and search performance", this means that THP is relevant on Search Head and Indexers, I never disabled THP on Universal Forwarders.

Anyway, if you run the Healt Check, that you can find in the Monitoring Console App (on Splunk Enterprise not on UFs), it shows the presence of enabled or disabled THP.

Bye.
Giuseppe

View solution in original post

0 Karma

Legend

Hi yutaka1005,
as you can find in https://docs.splunk.com/Documentation/Splunk/7.0.2/ReleaseNotes/SplunkandTHP THP bring a "30% degradation in indexing and search performance", this means that THP is relevant on Search Head and Indexers, I never disabled THP on Universal Forwarders.

Anyway, if you run the Healt Check, that you can find in the Monitoring Console App (on Splunk Enterprise not on UFs), it shows the presence of enabled or disabled THP.

Bye.
Giuseppe

View solution in original post

0 Karma

Builder

Thank you for answer.

So,
you mean that this log is not displayed is a specification, and it is no problem, right?

0 Karma

Legend

yes.
Bye.
Giuseppe

0 Karma