Splunk Search

My search keeps getting killed by 'Signal 9'

dkoops
Path Finder

For a certain search I keep getting the following error:

Search process did not exit cleanly, exit_code=0, description="killed by signal 9: Killed". Please look in search.log for this peer in the Job Inspector for more info.

Now the search.log doesn't show much useful information except that the job is indeed killed. Searching a bit on the error learned me that 'Signal 9' means that the job is killed 'externally', probably due to memory issues.

Strange thing is that this is only happening for this specific query, by far not the heaviest or most complex one running and that I never had any memory issues before. Also, the query works like a charm when the timespan is several days, but setting the timespan on 1 month or more gives me this error.

Anyone?

Tags (2)

dkoops
Path Finder

Thank you for the reply. The search doesn't contain memory intensive stuff like transactions. It is only used to calculate some variables imported in another search that does a simple regression on all volumes:

source='source1' OR source='source2' earliest=@d-31d latest=@d
| fields _time 'volume-id' name 'storage_used_percent'
| eval name=if(source=="source1", 'volume-id', name)
| stats count as count, sum(storage_used_percent) as Y sum(_time) as X, sum(eval(_time*storage_used_percent)) as XY, sum(eval(_time
_time)) as X2 latest(_time) as T1 earliest(_time) as T0 by name*

While the environment is quite big (>6000 volumes), even larger searches over a longer timespan work just fine. Also, after testing a bit, if I set the timerange to up to 26 days -> now, it works. A period longer than 26 days -> now, gives the signal 9 error..

0 Karma

lguinn2
Legend

What is the search? If it includes a transaction command, then you may very well be running out of memory.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!