Splunk® Enterprise

Release Notes

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Splunk Enterprise and NUMA architectures

CPU architectures featuring non-uniform memory access (NUMA) are increasingly popular, and many servers now offer them: multi-socket systems as well as single-socket, cluster-on-die CPUs. Software that runs on systems with NUMA, but is not optimized for NUMA architectures, can experience performance cliffs as the operating system migrates processes between different CPUs.

Splunk Enterprise is not optimized to run on NUMA architectures. Splunk has observed CPU usage increases of the order of 50% when running Splunk Enterprise on servers with 8 NUMA nodes, and eventual blockage of ingestion in periods of high search load, when the number of active processes on the server puts pressure on the operating system to migrate processes between CPUs more frequently.

Turn off NUMA in any system on which you run Splunk Enterprise software. Check the documentation of your operating system for details on how to do so.

Last modified on 23 March, 2023
Linux kernel memory overcommitting and Splunk crashes
Field alias behavior change

This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.1.0, 9.1.1, 9.1.2

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters