python-O/xoxo/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py” eats much of the swap space

[Isaias_Garcia]

Hi-

the process "python-O/xoxo/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py" is eating much of our the swap space.Is it okay if I can just kill this process and restart the SPlunk?Does it have dependencies?Please advise.TIA

[martin_mueller · Accepted solution]

That's Splunkweb's CherryPy webserver.

If that is a Search Head or otherwise an instance that needs the web UI then it's safe to restart that using $SPLUNK_HOME/bin/splunk restart splunkweb - active users may experience a short interruption of service, but sessions and indexing and whatnot won't be affected.

If that's an Indexer, Heavy Forwarder, or any other instance that doesn't need the web UI then you can just turn it off in web.conf:

[settings]
startwebserver = 0

[jawaharas]

@martin_mueller

The client name (/xyz/splunk/bin/splunk restart splunkweb) mentioned the answer is edited.