Why is there an error when searching on search head?

[AishwaryaAlhat]

Hi,

If I search on search head, I am getting this error:

Monitoring detail of the indexer machine:

Can anyone help with this issue? I could not figure out what's and where is the problem. Thanks. 

[richgalloway]

The error message recommended checking splunkd.log on the peer and also to check search.log.  Did you do that?  What did you find?

[AishwaryaAlhat]

Hi Rich,

Thank you for reply. Yes, I checked the splunkd.log and also the resource_usage.log. I have attached the screenshot for more understanding. 

this is the PID that gets killed.

[richgalloway]

The Out-of-Memory (OOM) Killer stopped Splunk - which would explain why the SH did not get a response.  Verify the box meets Splunk's reference hardware specs.  Add more memory, if possible.

Check the search being run at the time to see if it can be made to use less memory.  Certain commands, like join and transaction, use a lot of memory and often can be avoided.