Higher memory usage with 9.4.0 splunkd process.

[hrawat]

Apart from https://community.splunk.com/t5/Splunk-Enterprise/Linear-memory-growth-with-Splunk-9-4-0-and-above/m...
Some splunk instances(UF/HF/SH/IDX) might see higher memory usage after the upgrade.

hrawat_0-1740696908616.png

9.4.0 has introduced new active channel cache. It has a cache TTL of 3600 sec.

active_eligibility_age = <integer>
* The time, in seconds, after which splunkd removes an idle input
  channel from the active channel cache to free up memory.
* Default: 3600

Before 9.4.0, splunkd was using inactive channel cache. It had a cache ttl of 330 sec. It's not used anymore.

inactive_eligibility_age_seconds = <integer>
* Time, in seconds, after which an inactive input channel will be removed from
  the cache to free up memory.
* Default: 330

Because of high active channel cache TTL, splunkd memory footprint might be higher on some splunk deployments.

In limits.conf reduce active channel cache TTL to 330 ( 9.4.2 onwards, by default it's 330)

[input_channels]
active_eligibility_age = 330