Pivot failing to load data unless accelerated?

[pj]

I have been having issues with the Pivot table failing to load, when an underlying data model seemingly has a number of attributes added to it.

For example, I created a new data model with a Root Event Object Type and the following Object Constraints:

index=_internal sourcetype=splunkd

If I do nothing further, I am able to pivot off this fine. However, if I go back into the data model manager and select to add all the auto-extracted fields, then go try pivoting off it, I get 0 results and an error in the Pivot tool.

The search job has failed due to an
error. You may be able view the job in
the Job Inspector. Job Terminated
Unexpectedly.

If I then select to 'Open in Search' from the Pivot GUI, then the data loads absolutely fine using the | pivot command. This same situation happens for other data like access_combined.

Here is the odd part - If I select to accelerate the model, then the pivot tool renders the data without any errors...

I have another model under acceleration, that additionally has a Root Transaction Event Type and when trying to load this (even tho working in preview), I get this error:

Error in 'TSCollectProcessor': Failed
to create TSIDX event in
namespace='/opt/splunk/var/run/splunk/dispatch/1399297255.111/tsidxstats'
errcode=1

Again, the above works when opening in search and viewing the underlying pivot search.

I am running this on a Amazon Linux AMI.

[pj · Accepted solution]

This turned out to be a lack of memory on the server... Increasing the memory fixed the issue. Interestingly, I guess that also means accelerated data models use less memory.