https://community.splunk.com/t5/Splunk-Search/How-to-estimate-Splunk-memory-usage/m-p/186848#M53817 <P>Is there a reason you're still running on Splunk 5.0.4? Typically it's not recommend to start altering those defaults. There have been several improvements between the current version of Splunk and the one you're running. </P> Sun, 19 Jun 2016 22:12:49 GMT ryanoconnor 2016-06-19T22:12:49Z https://community.splunk.com/t5/Splunk-Search/How-to-estimate-Splunk-memory-usage/m-p/186847#M53816 <P>Could please someone tell what is the best value I should set for the "<STRONG>max_mem_usage_mb</STRONG>" and "<STRONG>max_rawsize_perchunk</STRONG>" ?</P> <P>In my search, an indexer outputs following the error message "ERROR databasePartitionPolicy - Max Raw Size Limit Exceeded", and a search head also outputs "WARN StatsProcessor - reached limit max_mem_usage_mb=200, results may be incomplete."<BR /> These errors must be related to parameters "max_mem_usage_mb" and "max_rawsize_perchunk," so I'm planning to change these parameters from default value.</P> <P>Although, these parameters default values are here.<BR /> max_mem_usage_mb = 200 (MB)<BR /> max_rawsize_perchunk = 100 (MB)<BR /> actual memory usage of splunkd process goes up to more than 1.3 Gbyte (in TOP command RES size), which does not make sense for me.</P> <P>Anyway, does anyone know good way to estimate the size of memory for splunk usage?</P> <P>some information here<BR /> my splunk version: 5.0.4<BR /> search event counts: 50M+ event (w/ 3 indexers and 1 search head)<BR /> use command: search, stats and more</P> <P>thank you.</P> Mon, 28 Sep 2020 17:21:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-estimate-Splunk-memory-usage/m-p/186847#M53816 mpfsplunk01 2020-09-28T17:21:35Z https://community.splunk.com/t5/Splunk-Search/How-to-estimate-Splunk-memory-usage/m-p/186848#M53817 <P>Is there a reason you're still running on Splunk 5.0.4? Typically it's not recommend to start altering those defaults. There have been several improvements between the current version of Splunk and the one you're running. </P> Sun, 19 Jun 2016 22:12:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-estimate-Splunk-memory-usage/m-p/186848#M53817 ryanoconnor 2016-06-19T22:12:49Z