Splunk Search

On RH 6 and Splunk 6 my searches are consuming lots of CPU

jbsplunk
Splunk Employee
Splunk Employee

Using redhat 6, I've noticed that my Splunk instance has searches that are consuming large amounts of CPU and I am experiencing quite a bit of latency. Has anyone else seen this? Is there something I can do to easily mitigate this problem?

1 Solution

Chubbybunny
Splunk Employee
Splunk Employee

I'm suspecting Transparent Huge Pages (THP) is enabled, as of RH 6 I believe this was enabled by default to deal with Oracle Databases or Big DATA.

for more information. https://blogs.oracle.com/linux/entry/performance_issues_with_transparent_huge

To disable it:
/sys/kernel/mm/transparent_hugepage/enabled = never

View solution in original post

Chubbybunny
Splunk Employee
Splunk Employee

I'm suspecting Transparent Huge Pages (THP) is enabled, as of RH 6 I believe this was enabled by default to deal with Oracle Databases or Big DATA.

for more information. https://blogs.oracle.com/linux/entry/performance_issues_with_transparent_huge

To disable it:
/sys/kernel/mm/transparent_hugepage/enabled = never

malmoore
Splunk Employee
Splunk Employee

We will have an official statement on this in the Splunk documentation shortly. I'll update this comment with appropriate URLs at the proper time.

0 Karma

Ellen
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...