Hi , I am currently experiencing high memory usage on my indexers when i saw the memory usage , i saw a high amount of memory caches below, total used free shared buffers cached Mem: 516761 477169 39592 0 1158 457892 -/+ buffers/cache: 18117 498644 Swap: 51199 551 50648
How safe is it to clear buffers and cache ? If i clear caches is it will create any issue like deleting data make indexers down ? I am thinking to clear it using these commands : sync; echo 1 > /proc/sys/vm/dropcaches. sync; echo 3 > /proc/sys/vm/dropcaches
Your memory usage looks normal for an indexer. You can clear the cache but it's going to quickly fill up again which is a good thing since it helps you avoid unnecessary disk I/O. Splunk will still be able to use the memory when needed. What kind of application problem are you experiencing?