All,
I have a user who's job used 6+gigs of ram. Is there a way for me to cap their memory usage? If so how does that "appear" to the user when they go over ram? Some sort of "exceeding memory error" I woudl guess?
Have a look at this http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf?ac=partner_smt#Memory_tracker