Can splunk-optimize kill my box?

howyagoin — Tue, 26 Apr 2011 03:31:33 GMT

Last night around 2345 a splunk-optimize process seems to have kicked off, and my server has essentially been unresponsive all day since. I will get remote hands on the box tomorrow at the soonest (grr, holiday weekends) but in the mean time I'm wondering if anyone else has seen this type of behaviour.

I have one working shell on the box at the moment, any further attempts to connect are met with failure, and other sessions hung after a few commands, so I'm extremely hesitant to do much till I can get to the console.

From ps:


root     64784 100.0  0.2  2595160  78012   ??  Rs   11:44PM 809:35.51 splunk-optimize -d /Volumes/foo/Applications/splunk/var/lib/splunk/zz/db/hot_v1_104

That %CPU varies, so whatever this process is seems to actually still be going. I tried (perhaps foolishly) to kill -9 it, but it made no difference.

I realise this is a longshot, but, just wondering if others have had issues with this process on particularly large indices.

For what it's worth, the OS is OS X 10.6.7.

Re: Can splunk-optimize kill my box?

netwrkr — Tue, 26 Apr 2011 12:58:41 GMT

killall -9 splunk ? It's probably chewing up all available disk io.

Re: Can splunk-optimize kill my box?

howyagoin — Tue, 26 Apr 2011 20:49:32 GMT

I ended up rebooting. Killing the optimize didn't help, and even ps was getting wedged telling me about what was running. Oh well.

topic Re: Can splunk-optimize kill my box? in Monitoring Splunk

Can splunk-optimize kill my box?

Re: Can splunk-optimize kill my box?

Re: Can splunk-optimize kill my box?