Splunk Search

On RH 6 and Splunk 6 my searches are consuming lots of CPU

jbsplunk
Splunk Employee
Splunk Employee

Using redhat 6, I've noticed that my Splunk instance has searches that are consuming large amounts of CPU and I am experiencing quite a bit of latency. Has anyone else seen this? Is there something I can do to easily mitigate this problem?

1 Solution

Chubbybunny
Splunk Employee
Splunk Employee

I'm suspecting Transparent Huge Pages (THP) is enabled, as of RH 6 I believe this was enabled by default to deal with Oracle Databases or Big DATA.

for more information. https://blogs.oracle.com/linux/entry/performance_issues_with_transparent_huge

To disable it:
/sys/kernel/mm/transparent_hugepage/enabled = never

View solution in original post

Chubbybunny
Splunk Employee
Splunk Employee

I'm suspecting Transparent Huge Pages (THP) is enabled, as of RH 6 I believe this was enabled by default to deal with Oracle Databases or Big DATA.

for more information. https://blogs.oracle.com/linux/entry/performance_issues_with_transparent_huge

To disable it:
/sys/kernel/mm/transparent_hugepage/enabled = never

malmoore
Splunk Employee
Splunk Employee

We will have an official statement on this in the Splunk documentation shortly. I'll update this comment with appropriate URLs at the proper time.

0 Karma

Ellen
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...