Splunk Search Head show 4GB instead of 16GB after upgrade

[thanh_on]

Dear fellas,

I have an issue on Monitoring Console that show wrong information of instance after upgrade from 9.2.2 up to 9.4.1 (latest version).

Is this a bug or I need to change some configuration ?

Thanks & Best regards.

[livehybrid]

Hi @thanh_on 

Please can you confirm that you are running Splunk on a VM/Physical server, not inside Docker? 

Also - please could you run the following and let us know what is returned?

index=_introspection  host=YourHostname component=HostWide earliest=-60m
| dedup data.instance_guid
|  table data.mem*

and

| rest /services/server/info splunk_server=local
| table guid host physicalMemoryMB

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[thanh_on]

Dear @livehybrid, yes I confirm that my Splunk instances are running on VMs

Query 1

Query 2

Regards.

[kiran_panchavat]

@thanh_on 

First, confirm the actual memory available on the server hosting the Search Head. If this is a virtual machine (VM), check the hypervisor (e.g., VMware, Hyper-V) to ensure it’s allocated 16GB. For a physical server or VM, log into the operating system and run a command like free -h (Linux) or systeminfo | find "Total Physical Memory" (Windows) to verify the OS sees 16GB. If the OS only reports 4GB, the issue is likely with the server configuration or VM settings, not Splunk fix that first by adjusting the VM allocation or checking hardware.

[kiran_panchavat]

@thanh_on 

The Monitoring Console uses the splunkd process to gather resource usage stats (e.g., via the rest endpoint /services/server/info). An upgrade might have disrupted this data collection, causing it to report stale or incorrect values.

Run this search on the Search Head to manually verify what Splunk detects:

| rest /services/server/info splunk_server=local
| table host physicalMemoryMB

[kiran_panchavat]

@thanh_on 

If your Search Head is running on a virtual machine (VM) or container, the upgrade process might not have properly refreshed the resource allocation visible to Splunk. For instance, the OS might report only 4GB to Splunk due to a misconfigured VM or cgroup setting.

On the Search Head, run a system command like free -m (on Linux) or systeminfo (on Windows) to confirm the OS sees 16GB. If the OS reports 16GB but Splunk shows 4GB, it’s likely a Splunk-side issue. If the OS itself shows 4GB, check your VM or hardware configuration.

Linux:-

free -m

Windows:-

systeminfo 

[kiran_panchavat]

@thanh_on 

The Monitoring Console relies on data collected from the Splunk instance, often via internal logs or REST API endpoints. After an upgrade, it’s possible that the console is still displaying cached or outdated information about the system resources.

Restart the Splunk instance (splunk restart) on the Search Head to force a refresh of system metrics. Then, check the Monitoring Console again after a few minutes to see if the memory updates to 16GB.