Monitoring Splunk

Can you hot add RAM to a splunk searchhead virtual machine without a restart of Splunkd

fsolercasanova
Explorer

We are running our Splunk Enterprise Deployment inside of VSphere. We are wondering if the Splunkd service on the Search Head will require a restart if RAM is added to the VM while it is running or if it will begin using it automatically.

I did not see any information about it in:
https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf

However, https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Configurationfilechangesthatrequirerestart
mentions requiring a restart after system changes to the indexer
"Changes to general indexer settings (minimum free disk space, default server name, etc.)"

If anyone has experience with this, even on other VM Platforms feel free to post.

1 Solution

jessec_splunk
Splunk Employee
Splunk Employee

Even if hot-adding memory is supported by vSphere, the real question is whether your guest OS will see and use that expanded memory. At the end of the day, the question boils down to "Do you 100% trust that the full stack will function normally after you hot-add RAM?" If not, I would restart the guest OS and Splunkd. This applies to hot-add storage, network interface changes, and hot-add vCores.

A little downtime is totally worth not spending hours tracking down this cause.

View solution in original post

codebuilder
SplunkTrust
SplunkTrust

Any changes to CPU or memory allocation on VMWare VM's require that the VM be powered off first.

You can add more virtual disks, NIC's, etc. in uptime, but not memory or CPU.

----
An upvote would be appreciated and Accept Solution if it helps!

jessec_splunk
Splunk Employee
Splunk Employee

Even if hot-adding memory is supported by vSphere, the real question is whether your guest OS will see and use that expanded memory. At the end of the day, the question boils down to "Do you 100% trust that the full stack will function normally after you hot-add RAM?" If not, I would restart the guest OS and Splunkd. This applies to hot-add storage, network interface changes, and hot-add vCores.

A little downtime is totally worth not spending hours tracking down this cause.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...