I am using Splunk 5.0.2 and I see many CLOSE_WAIT when running netstat -an command.
Splunkweb becomes unresponsive and I have to restart splunk to fix the issue.
This is a bug in the cherrypy threading code where the number of worker threads are reduced to a really low amount and no new threads are allowed to spawn.
This has been fixed in 5.0.3 but if you are using versions pre-5.0.3 then you can workaround the issue by modifying web.conf on all of the search heads.
Please add below settings in web.conf and restart your splunk instance.
server.thread_pool_max = 30
server.thread_pool_max_spare = 31
This is a bug in the cherrypy threading code where the number of worker threads are reduced to a really low amount and no new threads are allowed to spawn.
This has been fixed in 5.0.3 but if you are using versions pre-5.0.3 then you can workaround the issue by modifying web.conf on all of the search heads.
Please add below settings in web.conf and restart your splunk instance.
server.thread_pool_max = 30
server.thread_pool_max_spare = 31