topic Re: Why is /opt/splunk/var/run/searchpeers folder is filling up? in Splunk Search

Why is /opt/splunk/var/run/searchpeers folder is filling up?

mbagali_splunk — Tue, 30 Jan 2018 11:59:15 GMT

Splunk dose not clean up $SPLUNK_HOME/var/run/searchpeers and this leads to filling up of /opt/splunk/

Re: Why is /opt/splunk/var/run/searchpeers folder is filling up?

mbagali_splunk — Tue, 29 Sep 2020 17:55:21 GMT

This is a known bug (SPL-140831) were Splunk dose not clean up $SPLUNK_HOME/var/run/searchpeers.

Affected splunk versions: 6.5.1,6.5.2,6.5.3,6.5.4,6.5.6,

Fixed version is : 6.5.6+

This issue is caused when a lookup exceeds the max_memtable_bytes settings in limits.conf.

Please refer below document for more details:

http://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Limitsconf#.5Blookup.5D

Work around:

We need to Increase "max_memtable_bytes" under [lookup] inside limits.conf , so that the largest lookup won't get indexed.

Re: Why is /opt/splunk/var/run/searchpeers folder is filling up?

skoelpin — Tue, 30 Jan 2018 15:35:13 GMT

Thanks for sharing. You should accept this as the answer so future Splunkers can see how to resolve the issue

Re: Why is /opt/splunk/var/run/searchpeers folder is filling up?

nls7010 — Mon, 09 Mar 2020 14:35:26 GMT

I am running version 7.2.6 and I have this issue as well. I did the search for lookups and did not get anything back. As far as I know, my customers are not using them at the moment. I am having a daily issue with disk space due to the bundles not being removed. Is there a way to keep the .bundle files down to only 3 at max at a time? Or something like that. I really don't want to have to delete the indexers (We have six) everytime we reach spacing issues.