Heavy Forwarder High CPU and memory usage on Splunk Cloud

Available Languages

Updated:October 1, 2026
Document ID:SPLK052160

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

Inconsistent CPU and memory usage spikes on a Heavy Forwarder causing Out Of Memory issues


Investigation

Diag vs. OS CPU Core Reporting

The diag output from Splunk showed only 8 available CPUs.

However, the OS reported 16 CPUs, based on the configuration:
Cores per socket: 2, Sockets: 8, and Threads per core: 1 → 2 × 8 = 16 CPUs.

Understanding Physical vs. Logical Cores

Splunk identifies usable CPUs based on what the OS and splunkd process can access.

Some environments use hyper-threading, where a single physical core acts like two logical (or virtual) CPUs.

In this case, only 8 physical CPU cores were actually available to Splunk, making the instance under-provisioned for the 12-core minimum requirement.


Resolution

Validate CPU Allocation

Confirm that the VM host allocates at least  physical CPU cores to meet Splunk’s minimum requirements.

To obtain the physical CPU Cores on a particular machine, access the CLI and run this command:

lscpu

The physical CPU Cores appear under Cores(s) per Socket.


Reference hardware

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products