Splunk Search

On RH 6 and Splunk 6 my searches are consuming lots of CPU

jbsplunk
Splunk Employee
Splunk Employee

Using redhat 6, I've noticed that my Splunk instance has searches that are consuming large amounts of CPU and I am experiencing quite a bit of latency. Has anyone else seen this? Is there something I can do to easily mitigate this problem?

1 Solution

Chubbybunny
Splunk Employee
Splunk Employee

I'm suspecting Transparent Huge Pages (THP) is enabled, as of RH 6 I believe this was enabled by default to deal with Oracle Databases or Big DATA.

for more information. https://blogs.oracle.com/linux/entry/performance_issues_with_transparent_huge

To disable it:
/sys/kernel/mm/transparent_hugepage/enabled = never

View solution in original post

Chubbybunny
Splunk Employee
Splunk Employee

I'm suspecting Transparent Huge Pages (THP) is enabled, as of RH 6 I believe this was enabled by default to deal with Oracle Databases or Big DATA.

for more information. https://blogs.oracle.com/linux/entry/performance_issues_with_transparent_huge

To disable it:
/sys/kernel/mm/transparent_hugepage/enabled = never

View solution in original post

malmoore
Splunk Employee
Splunk Employee

We will have an official statement on this in the Splunk documentation shortly. I'll update this comment with appropriate URLs at the proper time.

0 Karma

Ellen
Splunk Employee
Splunk Employee
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!