Deployment Architecture

How to prevent search head crashes due to large exports

danielbb
Motivator

A user tried to export 110,000,000 events today to excel and crashed our SH twice.

How can we prevent it?

0 Karma

mayurr98
SplunkTrust
SplunkTrust

could you pls check, if crash* log exists in your search head $SPLUNK_HOME$\var\log\splunk. If it then you would possibly find an error due to which it crashed.

0 Karma

danielbb
Motivator

No crash report there...

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!