Lots of Splunkd.exe processes

[ARothman]

I just found that my Windows server based Splunk console is running 14 splunkd.exe services simultaneously... is this due to the latest version of Splunk (5.0.1) or does this, possibly, have to do with the number of real-time alerts I have configured in the console? Overall, the processes aren't using that much CPU on the average (spikes here and there), but they are using almost a full gig of RAM on my server:

[sowings · Accepted solution]

Splunk forks a splunkd process (in your case, a .exe) to run each search. One of those processes will be the "main" splunkd, the rest will be as the result of a search, such as a dashboard, or the real time alerts you've described.

[sowings]

Note that "small searches on a short interval" can often serve as a "good enough" approximation to real-time searches / alerts. In this instance, the search process (splunkd.exe) would live long enough to complete the search, but would not persist after that. If the search only takes 10s to run, and it's run on a 5 minute basis, the overall memory and CPU footprints would be pretty small.

[ARothman]

Hrm... well, if that's the case, looks like I'll either be letting management know that we'll likely have to increase the RAM on this box if they want me to go ahead with creating dozens more real-time alerts... or those alerts simply can't be real-time 😄

Thanks for the confirmation.