uberAgent splunkd Process Utilizing Memory

  • Splunk 8.0.7
  • SUSE Linux 12.5
  • uberAgent 6.0
  • RAM - 128Gb
  • CPU - 48 vCPU

I have Splunk processes utilizing memory up to 85%, the oom-reaper will activate and kill the process, this will create a zombie process, Splunk will report the indexer down, memory will drop back down and this whole process will start over.  This is happening on all 12 indexers and always an uberAgent process.

Below are the screen shots of the PID process information, and TOP screens showing 60% memory usage, 70% memory usage, the oom-reaper process activated and then showing memory after the process has been removed.


  • 0
    Helge Klein

    Hi Mark,

    Thanks for your detailed description of the issue. We'll analyze the data and get back to you soon.

  • 0
    Dominik Britz

    Forwarded to our support system. We will post the results here, too.

Please sign in to leave a comment.