Hello All, I have a splunk lincense master and splunkd service is eating away all of the swap lvm space. I would like to increase the swap , I want to know the potential impact of restarting splund service on this master. Is it safe to stop this service until we fix the swap? How long can this service be down?
Hi,
Have you looked at license master memory usage(RAM) ? Generally swap memory will be used when server doesn't have enough memory (RAM).
Additionally if you have free space available in Volume Group(VG) then you can increase the SWAP without restarting splunk process or server. If you want to reboot the server to add additional disk, indexing will work as it it but search functionality will work for 72 hours only. Ref. https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Aboutlicenseviolations#Violations_due_to_pr...