Linux transparent hugetables support,
enabled=”always” defrag=”always”
1. Go to your Search Head OR Indexer and open a GUI :
https://:8000
2. Go to “Searching and Reporting” Application from the “Apps” Menu on the top left
3. Give the following Splunk Query on the Search Box :
index=_internal (transparent always)
OR recommended sourcetype=splunkd
| stats count by message,
If the output comes as :
Linux transparent hugetables support, enabled=”always” defrag=”always”
Remedy :
1. Go to box ( Search Head ) OR ( Indexer ) as
ssh OR
2. Check if your OS is affected:
cat /sys/kernel/mm/transparent_hugepage/enabled
O/P : [always] madvise never
cat /sys/kernel/mm/transparent_hugepage/defrag
O/P : [always] madvise never
3. Fix on OS level:
echo never > /sys/kernel/mm/transparent_hugepage/enabled
echo never > /sys/kernel/mm/transparent_hugepage/defrag
4. Validate on OS level:
cat /sys/kernel/mm/transparent_hugepage/enabled
O/P : always madvise [never]
cat /sys/kernel/mm/transparent_hugepage/defrag
O/P : always madvise [never]
Note : Hope whenever you encounter :
Linux transparent hugetables support, enabled=”always” defrag=”always”
the above error, you will be able to solve it immediately!!
Happy Splunking !
What’s your Reaction?
+1
+1
+1
+1
+1
2
+1
+1
You can also know about : Received event for unconfigured/disabled index...stash ( 1 missing total )
