https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137046#M37539 <P>Here you go Mark,<BR /> <IMG src="http://i.imgur.com/9LveYAo.png" alt="alt text" /></P> Tue, 24 Feb 2015 08:59:38 GMT Stabbles 2015-02-24T08:59:38Z https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137043#M37536 <P>Splunk newbie here,<BR /> I've installed Splunk onto a small ubuntu VM (512MB RAM and 20GB disk space) This should be OK because my data is very small.<BR /> I'm able to run the search <STRONG>sourcetype=accounts_made</STRONG> and it returns the results for all time very quickly. However if I try and pipe the results to a timechart; <STRONG>sourcetype=accounts_made | timechart max(accounts)</STRONG> I receive the error <EM>std::bad_alloc The search job has failed due to an error. You may be able view the job in the Job Inspector.</EM> Even if I try and plot the results for the past 15 minutes it gives up immediately.</P> <P>Any advice would be appreciated!</P> <P>Edit: Running the search in Verbose mode seems to work, however I can't make any dashboard panels because they always show the error above.</P> Thu, 12 Feb 2015 21:42:30 GMT https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137043#M37536 Stabbles 2015-02-12T21:42:30Z https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137044#M37537 <P>any clues on this?<BR /> I'm running into the same issue...</P> Tue, 24 Feb 2015 08:30:41 GMT https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137044#M37537 zaphod1984 2015-02-24T08:30:41Z https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137045#M37538 <P>@Stabbles - Can you view it in the job inspector and share a screenshot please</P> Tue, 24 Feb 2015 08:51:25 GMT https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137045#M37538 markthompson 2015-02-24T08:51:25Z https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137046#M37539 <P>Here you go Mark,<BR /> <IMG src="http://i.imgur.com/9LveYAo.png" alt="alt text" /></P> Tue, 24 Feb 2015 08:59:38 GMT https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137046#M37539 Stabbles 2015-02-24T08:59:38Z https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137047#M37540 <P>This is just Out of memory error, sorry.<BR /> Read this page <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Installation/Systemrequirements">http://docs.splunk.com/Documentation/Splunk/6.2.1/Installation/Systemrequirements</A> - you just have to have 1GB RAM.</P> Tue, 24 Feb 2015 10:47:23 GMT https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137047#M37540 lukasz92 2015-02-24T10:47:23Z https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137048#M37541 <P>hi, that's the same conclusion i also came to. (had splunk running on a VM with 512Mb)</P> Tue, 24 Feb 2015 11:44:31 GMT https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137048#M37541 zaphod1984 2015-02-24T11:44:31Z https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137049#M37542 <P>Its because you are running it in fast mode . Change it to verbose mode will resolve you problem.</P> Thu, 08 Sep 2016 05:19:22 GMT https://community.splunk.com/t5/Splunk-Search/Error-std-bad-alloc-Whenever-I-try-to-visualize-a-search/m-p/137049#M37542 vivek_manoj 2016-09-08T05:19:22Z