Splunk Search

std::bad_alloc

arrowecssupport
Communicator

I am running the search "index="os_var_log" | stats count" and getting this error after upgrading to Version 8 From version 6.5.5

Below is the job log, any ideas. This happens on any of my indexes big or small.

12-06-2019 12:31:38.706 ERROR SearchPhaseGenerator - Fallback to two phase search failed:std::bad_alloc
12-06-2019 12:31:38.707 ERROR SearchOrchestrator - std::bad_alloc
12-06-2019 12:31:38.707 ERROR SearchStatusEnforcer - sid:1575635498.9511 std::bad_alloc
12-06-2019 12:31:38.707 INFO  SearchStatusEnforcer - State changed to FAILED due to: std::bad_alloc
12-06-2019 12:31:38.707 INFO  SearchStatusEnforcer - Enforcing disk quota = 10485760000
12-06-2019 12:31:38.709 INFO  DispatchStorageManager - Remote storage disabled for search artifacts.
12-06-2019 12:31:38.709 INFO  DispatchManager - DispatchManager::dispatchHasFinished(id='1575635498.9511', username='admin')
12-06-2019 12:31:38.710 INFO  UserManager - Unwound user context: admin -> NULL
12-06-2019 12:31:38.710 INFO  UserManager - Unwound user context: admin -> NULL
12-06-2019 12:31:38.710 INFO  LookupProviderFactory - Clearing out lookup shared provider map
12-06-2019 12:31:38.712 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: std::bad_alloc
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...