Splunkd using all memory after upgrade from 5 to 6.1.1

[jcrane]

Splunkd is taking almost 100% of memory after upgrading to 6.1.1. The box has become very sluggish and the web interface is basically unresponsive.

Looking for help in anyway.

Thanks

Update: I left it over night with no data being sent to it and it is doing the same thing still. I just don't know what to do with this now.
Does splunkd do some migration of the DB after an upgrade?

[rsolutions]

Are you running Splunk on linux (RHEL)? How much memory do you have on the server? Have you looked at this:

http://docs.splunk.com/Documentation/Splunk/6.2.1/ReleaseNotes/SplunkandTHP

This may cause Splunk to under perform with THP enabled and even not release memory back to the server. The linux out of memory manager can also start to kill splunkd if it consumes too much memory.

http://www.oracle.com/technetwork/articles/servers-storage-dev/oom-killer-1911807.html

[haliakbar_splun]

Do you have Splunk_TA_Windows installed? If so check the version, if its old I would upgrade to 4.7.3

[okrabbe_splunk]

You should contact support. There is a lot that could be happening and they will need a diag.

http://www.splunk.com/support