High swap memory on the Search Head

Available Languages

Updated:September 29, 2026

Document ID:SPLK048938

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

The swap memory consistently stayed very high and it was also causing performance issues on the Search Head.

Investigation

Observed that the ulimit open files (descriptors) value was too low.

File descriptor cache stress was noticed.

09-05-2026 22:19:08.916 +0000 INFO TailReader [1178677 tailreader0] - File descriptor cache is full (100), trimming...

Resolution

On OS level -

1. Suggested to increase the value of ulimit -n which is with respect to open files.
-Increased it to 65535 and higher.

[OR]

On Splunk level -

2. Adjust and increase the max_fd attribute in the local directory of limits.conf

3. Navigate to /opt/splunk/etc/system/local/limits.conf -