every night my Server Crashes saying out of memory error however I have more than enough memory.
In event logs get a : Unable to allocate dynamic memory buffer ,and Faulting application name: splunkd
faulting module name: Ucrtbase.dll
Systems log has a low memory condition looks like Splunk has a memory leak so how do i find out what is causing it ?
Do you have a scheduled search that runs overnight and consumes a lot of memory?
How much is "more than enough memory"?
Once you've ruled out a rogue search and confirm the system meets the recommended hardware specs, consider opening a case with Splunk Support.