https://community.splunk.com/t5/Splunk-Search/Why-is-the-memory-usage-high-on-the-indexer-when-running-a/m-p/144295#M40151 <P>The search <CODE>index=main | stats count</CODE> is taking a lot of memory on the indexer when there are lots of events. Isn't the indexer doing an incremental reduce to produce the count? Why would it need a lot of memory?</P> Mon, 08 Jun 2015 13:06:04 GMT marcusnilssonmr 2015-06-08T13:06:04Z https://community.splunk.com/t5/Splunk-Search/Why-is-the-memory-usage-high-on-the-indexer-when-running-a/m-p/144295#M40151 <P>The search <CODE>index=main | stats count</CODE> is taking a lot of memory on the indexer when there are lots of events. Isn't the indexer doing an incremental reduce to produce the count? Why would it need a lot of memory?</P> Mon, 08 Jun 2015 13:06:04 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-the-memory-usage-high-on-the-indexer-when-running-a/m-p/144295#M40151 marcusnilssonmr 2015-06-08T13:06:04Z https://community.splunk.com/t5/Splunk-Search/Why-is-the-memory-usage-high-on-the-indexer-when-running-a/m-p/144296#M40152 <P>Compare the search mode.<BR /> For a basic search like this one, make sure that you are running the search in "fast mode" not in "verbose or smart mode",<BR /> It may do a different if you have many automatic fields extractions / lookups.<BR /> What is the nature of your data, are they key/values, or do they require complex regexes to parse at search time ?</P> <P>About the memory map reduce, this would be more relevant if you have several indexers.</P> Sun, 14 Jun 2015 03:24:16 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-the-memory-usage-high-on-the-indexer-when-running-a/m-p/144296#M40152 yannK 2015-06-14T03:24:16Z