Deployment Architecture
Highlighted

How to prevent search head crashes due to large exports

Motivator

A user tried to export 110,000,000 events today to excel and crashed our SH twice.

How can we prevent it?

0 Karma
Highlighted

Re: How to prevent search head crashes due to large exports

SplunkTrust
SplunkTrust

could you pls check, if crash* log exists in your search head $SPLUNK_HOME$\var\log\splunk. If it then you would possibly find an error due to which it crashed.

0 Karma
Highlighted

Re: How to prevent search head crashes due to large exports

Motivator

No crash report there...

0 Karma