Splunk Search

Why is a single instance of splunk not running query and giving an error "CacheManager - Last run failed to evict requested bytes"?

kmevans
New Member
03-09-2018 12:51:44.372 -0500 WARN  CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db
03-09-2018 12:51:44.372 -0500 INFO  CacheManager - Eviction results: count=0, test_count=0, bytes_evicted=0, bytes_needed=15912517632, elapsed_ms=1
03-09-2018 12:51:44.372 -0500 WARN  CacheManager - Unable to evict enough data. Evicted size=0 instead of size=15912517632

Cannot find any documentation of cause or resolution
Can use splunk gui but queries will not run

0 Karma

ryuj11n
Loves-to-Learn

Having the same issue, couldn't find the right solution 😞

0 Karma

kmevans
New Member

never mind .

0 Karma

woodcock
Esteemed Legend

Don't keep us in suspense, share your solution and then click Accept. Help others learn from your mistakes!

0 Karma
Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...