Apart from https://community.splunk.com/t5/Splunk-Enterprise/Linear-memory-growth-with-Splunk-9-4-0-and-above/m...
Some splunk instances(UF/HF/SH/IDX) might see higher memory usage after the upgrade.
9.4.0 has introduced new active channel cache. It has a cache TTL of 3600 sec.
active_eligibility_age = <integer> * The time, in seconds, after which splunkd removes an idle input channel from the active channel cache to free up memory. * Default: 3600
Before 9.4.0, splunkd was using inactive channel cache. It had a cache ttl of 330 sec. It's not used anymore.
inactive_eligibility_age_seconds = <integer> * Time, in seconds, after which an inactive input channel will be removed from the cache to free up memory. * Default: 330
Because of high active channel cache TTL, splunkd memory footprint might be higher on some splunk deployments.
In limits.conf reduce active channel cache TTL to 330 ( 9.4.2 onwards, by default it's 330)
[input_channels]
active_eligibility_age = 330
