Facing issue with indexer

[syedabuthahir]

Hi All,

One of our indexer is going down very frequently and i have observed this below error in the dmesg logs

 Out of memory: Kill process 20910 (splunkd) score 801 or sacrifice child
 Killed process 20914 (splunkd) total-vm:86320kB, anon-rss:9872kB, file-rss:0kB, shmem-res:0kB
 splunkd: page allocation failure: order:2, mode:0x35600d0
 CPU: 2 PID: 20914 Comm: splunkd Not tainted 3.10.0-693.11.6.el7.x86_64 #1

Can you please help me on this issue

Thank you

[PickleRick]

As the message says, you have too little memory in your machine for the load you want to impose on it. Splunkd process (or some other process running in the system) tries to allocate memory up to the point of exhaustion.

Firstly, make sure that you're not running other memory-intensive processes on that machine and secondly, check in monitoring console which searches use up most of memory. You might then decide whether to lower the memory limits for splunk (which might cause some searches to fail) or lower search concurrency limits (which might cause searches to be delayes or skipped). Or just add memory to the machine.