Apart from https://community.splunk.com/t5/Splunk-Enterprise/Linear-memory-growth-with-Splunk-9-4-0-and-above/m-p/712550#M21712 Some splunk instances(UF/HF/SH/IDX) might see higher memory usage after the upgrade. 9.4.0 has introduced new active channel cache. It has a cache TTL of 3600 sec. active_eligibility_age = <integer> * The time, in seconds, after which splunkd removes an idle input channel from the active channel cache to free up memory. * Default: 3600 Before 9.4.0, splunkd was using inactive channel cache. It had a cache ttl of 330 sec. It's not used anymore. inactive_eligibility_age_seconds = <integer> * Time, in seconds, after which an inactive input channel will be removed from the cache to free up memory. * Default: 330 Because of high active channel cache TTL, splunkd memory footprint might be higher on some splunk deployments. In limits.conf reduce active channel cache TTL to 330 ( 9.4.2 onwards, by default it's 330)     [input_channels] active_eligibility_age = 330         ... View more