Splunk Message : Search has been terminated. This is most likely due to an out of memory condition

[Naveen_4025]

Hello Everyone,
I'm attempting to search for queries in Splunk Free Edition. However, it worked well for some time, and then I got the error "Search has been terminated." This is most likely due to a lack of recollection." This occurs rather frequently. I created a free AWS instance using the Linux platform. Please suggest any solutions for these problems. (I've included a screenshot for reference.)

 

[richgalloway]

How much memory does the AWS instance have?  It should have at least 12GB.

It's possible your search query is too memory-intensive.  Use the fields command to remove unused fields and save memory.  Share the query so we can offer other suggestions to reduce memory use.

[Naveen_4025]

Hello.

Thank you for response.  I think it's 8GB. If I increase the memory will I be charged on AWS account?

Secondly, how can we save up the memory usage in my Splunk Console ?

[richgalloway]

I'm not an AWS expert, but increasing the amount of memory on the instance probably will incur additional cost.

The Monitoring Console (MC) should show how much memory searches are using.  In the MC, go to Resource Usage->Resource Usage: Instance