Monitoring Splunk

Can you hot add RAM to a splunk searchhead virtual machine without a restart of Splunkd

fsolercasanova
Explorer

We are running our Splunk Enterprise Deployment inside of VSphere. We are wondering if the Splunkd service on the Search Head will require a restart if RAM is added to the VM while it is running or if it will begin using it automatically.

I did not see any information about it in:
https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf

However, https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Configurationfilechangesthatrequirerestart
mentions requiring a restart after system changes to the indexer
"Changes to general indexer settings (minimum free disk space, default server name, etc.)"

If anyone has experience with this, even on other VM Platforms feel free to post.

1 Solution

jessec_splunk
Splunk Employee
Splunk Employee

Even if hot-adding memory is supported by vSphere, the real question is whether your guest OS will see and use that expanded memory. At the end of the day, the question boils down to "Do you 100% trust that the full stack will function normally after you hot-add RAM?" If not, I would restart the guest OS and Splunkd. This applies to hot-add storage, network interface changes, and hot-add vCores.

A little downtime is totally worth not spending hours tracking down this cause.

View solution in original post

codebuilder
Influencer

Any changes to CPU or memory allocation on VMWare VM's require that the VM be powered off first.

You can add more virtual disks, NIC's, etc. in uptime, but not memory or CPU.

----
An upvote would be appreciated and Accept Solution if it helps!

jessec_splunk
Splunk Employee
Splunk Employee

Even if hot-adding memory is supported by vSphere, the real question is whether your guest OS will see and use that expanded memory. At the end of the day, the question boils down to "Do you 100% trust that the full stack will function normally after you hot-add RAM?" If not, I would restart the guest OS and Splunkd. This applies to hot-add storage, network interface changes, and hot-add vCores.

A little downtime is totally worth not spending hours tracking down this cause.

Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...