
Splunk Enterprise and NUMA architectures
CPU architectures featuring non-uniform memory access (NUMA) are increasingly popular, and many servers now offer them: multi-socket systems as well as single-socket, cluster-on-die CPUs. Software that runs on systems with NUMA, but is not optimized for NUMA architectures, can experience performance cliffs as the operating system migrates processes between different CPUs.
Splunk Enterprise is not optimized to run on NUMA architectures. Splunk has observed CPU usage increases of the order of 50% when running Splunk Enterprise on servers with 8 NUMA nodes, and eventual blockage of ingestion in periods of high search load, when the number of active processes on the server puts pressure on the operating system to migrate processes between CPUs more frequently.
Turn off NUMA in any system on which you run Splunk Enterprise software. Check the documentation of your operating system for details on how to do so.
PREVIOUS Linux kernel memory overcommitting and Splunk crashes |
NEXT Field alias behavior change |
This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.1.0, 9.1.1, 9.1.2
Feedback submitted, thanks!