Can you hot add RAM to a splunk searchhead virtual machine without a restart of Splunkd

[fsolercasanova]

We are running our Splunk Enterprise Deployment inside of VSphere. We are wondering if the Splunkd service on the Search Head will require a restart if RAM is added to the VM while it is running or if it will begin using it automatically.

I did not see any information about it in:
https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf

However, https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Configurationfilechangesthatrequirerestart
mentions requiring a restart after system changes to the indexer
"Changes to general indexer settings (minimum free disk space, default server name, etc.)"

If anyone has experience with this, even on other VM Platforms feel free to post.

[codebuilder]

Any changes to CPU or memory allocation on VMWare VM's require that the VM be powered off first.

You can add more virtual disks, NIC's, etc. in uptime, but not memory or CPU.

[jessec_splunk · Accepted solution]

Even if hot-adding memory is supported by vSphere, the real question is whether your guest OS will see and use that expanded memory. At the end of the day, the question boils down to "Do you 100% trust that the full stack will function normally after you hot-add RAM?" If not, I would restart the guest OS and Splunkd. This applies to hot-add storage, network interface changes, and hot-add vCores.

A little downtime is totally worth not spending hours tracking down this cause.