Splunk Search

On RH 6 and Splunk 6 my searches are consuming lots of CPU

jbsplunk
Splunk Employee
Splunk Employee

Using redhat 6, I've noticed that my Splunk instance has searches that are consuming large amounts of CPU and I am experiencing quite a bit of latency. Has anyone else seen this? Is there something I can do to easily mitigate this problem?

1 Solution

Chubbybunny
Splunk Employee
Splunk Employee

I'm suspecting Transparent Huge Pages (THP) is enabled, as of RH 6 I believe this was enabled by default to deal with Oracle Databases or Big DATA.

for more information. https://blogs.oracle.com/linux/entry/performance_issues_with_transparent_huge

To disable it:
/sys/kernel/mm/transparent_hugepage/enabled = never

View solution in original post

Chubbybunny
Splunk Employee
Splunk Employee

I'm suspecting Transparent Huge Pages (THP) is enabled, as of RH 6 I believe this was enabled by default to deal with Oracle Databases or Big DATA.

for more information. https://blogs.oracle.com/linux/entry/performance_issues_with_transparent_huge

To disable it:
/sys/kernel/mm/transparent_hugepage/enabled = never

malmoore
Splunk Employee
Splunk Employee

We will have an official statement on this in the Splunk documentation shortly. I'll update this comment with appropriate URLs at the proper time.

0 Karma

Ellen
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...