Splunk error

[uagraw01]

Hello Splunkers!!

I am writing to bring to your attention a critical issue we are experiencing following our recent migration of Splunk from version 8.1.1 to 9.1.1.

During our routine operations, specifically while attempting to schedule reports from the dashboard using the noop command, we have encountered a "FATAL" error with the message indicating a "bad allocation."

Server reported HTTP status=400 while getting mode=resultsb'\n\n \n bad allocation\n \n\n

Please help me get it fix.

[kiran_panchavat]

@uagraw01 

This "Bad Allocation" error often indicates that the server is running out of memory while processing the request. It can occur during large searches or when the server's memory resources are insufficient.

This error "HTTP Status 400 (Bad Request)" typically means that the request sent to the server was malformed or incorrect in some way. You might want to check the request syntax and ensure all required parameters are correctly formatted.

Check the below resources : 

https://community.splunk.com/t5/Reporting/Searches-fail-with-quot-bad-allocation-quot-error/m-p/1976... 
https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/Noop 
https://docs.splunk.com/Documentation/Splunk/9.4.0/Search/Comments 

I would recommend you raise a support ticket. 

[uagraw01]

@kiran_panchavat Thanks for your response. 

My concern is that it worked fine in Splunk Enterprise 8.1.1, but after upgrading to version 9.1.1, I am encountering fatal errors and “bad allocation” issues for the same scheduled search.

[isoutamo]

Hi

Have you read what has changed when splunk is updated from 8.1 to 9.1? There is read me first document(s) which told those. Especially there could be some removed features which have worked on old but not in a new version!

Also if/when there are versions with higher patch level x.y.Z then you usually should select those instead of lower.

https://docs.splunk.com/Documentation/Splunk/9.1.1/Installation/AboutupgradingREADTHISFIRST

For example you found this from it “Splunk supports a direct upgrade to Splunk Enterprise 9.1 from versions 8.2.x and higher only”!

If you have updated directly from 8.1.1 to 9.1.1 this is not supported and now you have missed some important migration steps which modified needed component between versions. Currently splunk support upgrades over only one minor version like 8.1 to 9.0 or 8.2 to 9.1.

Also you should always train/test with test environment first and after you see that everything is ok then do those same steps with production.

Your best and only supported solution is use your backup and do your upgrade again with supported path. Also you must start splunk in each versions which you are using on path from source to destination version! It didn’t do those migration steps with this.

If you haven’t a backup then probably best option is create support ticket and ask if they have any instructions how you could try to fix the situation.

r. Ismo