Splunk Search

StatsBuffer::read: Row is too large for StatsBuffer, resizing buffer

joemcmahon
Explorer

When performing a query that creates a summary report, the associated search.log file shows:
ResultsCollationProcessor - writing remote_event_providers.csv to disk.

Then two hours later reports:

StatsBuffer::read: Row is too large for StatsBuffer, resizing buffer.  row_size=77060 needed_space=11536 free_space=153653063

This is soon followed by lots of ~min-by-min output of:

SummaryIndexProcessor - Using tmp_file=/opt/splunk/..../RMD....tmp messages.

What might be happening in that two hour window?  We are running Splunk Enterprise 9.1.1 under Linux.

@koronb_splunk @C_Mooney 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...