Error in 'databasePartitionPolicy': Max Raw Size Limit Exceeded

[jjozwik702]

Getting Error in 'databasePartitionPolicy': Max Raw Size Limit Exceeded on the overview page of the modsecurity app when I switch to longer timeframes.

My modsecurity audit log is about 220 megs.

Anyone know what this error means and how to fix it? Haven't been able to find anything regarding the Raw Size Limit..

[rsimmons]

This is a known issue (SPL-93527) where search process consumes some memory and throws the following error databasePartitionPolicy - Max Raw Size Limit Exceeded

The temporary workaround for this issue is to disable the BatchSearches:
limits.conf:
[search]
allow_batch_mode = false

[jjozwik702]

Additionally the server RAM spikes out when viewing most any of the overview pages.

[jjozwik702]

From splunkd.log

06-18-2014 18:43:45.010 +0000 WARN ProcessDispatchedSearch - PROCESS_SEARCH terminate called after throwing an instance of 'std::bad_alloc'
06-18-2014 18:43:45.010 +0000 WARN ProcessDispatchedSearch - PROCESS_SEARCH what(): std::bad_alloc

Memory jumps way up.
Wondering if this should run in concurrent mod instead.