Some Linux distributions typically have atransparent huge pages feature that is enabled by default; this causes some fairly significant performance losses with Splunk Enterprise (reportedly 30% or more), so Splunk suggests this feature be disabled. The process for doing this varies between distributions and versions, so you may need to search the web for instructions for your particular distribution. The following link has instructions for Red Hat Enterprise Linux versions 6 and 7:https://access.redhat.com/solutions/46111.
The following process works for RHEL 7.5:
Check to see if THP is enabled by using (root) cat /proc/cmdline. Look for transparent_hugepage=never in the results.
If this is missing, edit the /etc/sysconfig/grub file and add thetransparent_hugepage=never to theGRUB_CMDLINE_LINUXentry, as follows:
Then, run the: grub2-mkconfig -o/boot/grub2/grub.cfgcommandand restart the server. When it comes up, run the cat /proc/cmdline command again and verify the entry.