Indexer crashed after OS upgrade

Available Languages

Updated:September 29, 2026

Document ID:SPLK046171

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

User has indexers (IDX) v8.04 in a cluster environment, after the OS upgrade in one of the IDX member via upgrade command "yum update", this indexer keeps crashing every five minutes.

Upgrade was:
4.18.0-193.28.1.el8_2.x86_64 #1 SMP Thu Oct 22 00:20:22 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux - CentOS
To
4.18.0-240.1.1.el8_3.x86_64 #1 SMP Thu Nov 19 17:20:08 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux - CentOS

Investigation

While after the OS upgrade the Transparent Huge Pages (THP) was disabled, but 'vm.overcommit' was set to 2, this according to the logs:

INFO  ulimit - Linux transparent hugepage support, enabled="never" defrag="never"INFO  ulimit - Linux vm.overcommit setting, value="2"WARN  ulimit - This configuration of vm.overcommit is known to cause serious runtime problems
with Splunk. Typical symptoms include sporadic crashes due to memory allocation failures. 
Please fix by setting the value for vm.overcommit to "1" (always overcommit) or preferably 
"0" (heuristic overcommit) via sysctl, kernel boot parameters, or other method recommended 
by your Linux distribution.INFO  loader - SAML cert db registration with KVStore successfulINFO  CertStorageProvider - Updating status from unknown to starting

Resolution

You need to adjust overcommit memory via Linux command:

sysctl vm.overcommit_memory=0

Check the value at "cat /proc/sys/vm/overcommit_memory" and then reboot the machine.

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)

This Document Applies to These Products

Splunk Enterprise