Getting Data In

Why are we seeing high memory usage with a Splunk 6.2.3 forwarder installed on a Windows server?

New Member

We are currently having an issue with Splunk forwarder installed on a Windows server. It takes up a lot of memory utilization.

Any suggestion how to fix this? We are running Splunk 6.2.3. Help help. Thanks.

0 Karma


The amount of memory that a Splunk forwarder uses is directly related to the number of files that the forwarder is monitoring.

How many files is the forwarder monitoring? If you are not sure, log on the the machine and run

splunk list monitor

You may see that you are monitoring many files, including inactive files. The problem is that Splunk cannot be sure those files are inactive; it will continue to keep them in its list of files to monitor. If you can refine the stanzas in inputs.conf to monitor less - or remove the inactive files from the path that Splunk is monitoring - you will probably see an immediate reduction in the memory and CPU consumption. (You will have to restart the forwarder after making these changes.)

Of course, this is just a guess, based on not much information...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...