many CLOSE_WAIT and splunkweb is not responding

[cwl]

I am using Splunk 5.0.2 and I see many CLOSE_WAIT when running netstat -an command.

Splunkweb becomes unresponsive and I have to restart splunk to fix the issue.

[cwl · Accepted solution]

This is a bug in the cherrypy threading code where the number of worker threads are reduced to a really low amount and no new threads are allowed to spawn.

This has been fixed in 5.0.3 but if you are using versions pre-5.0.3 then you can workaround the issue by modifying web.conf on all of the search heads.

Please add below settings in web.conf and restart your splunk instance.

server.thread_pool_max = 30 

server.thread_pool_max_spare = 31