Splunk Search
Highlighted

Why is a single instance of splunk not running query and giving an error "CacheManager - Last run failed to evict requested bytes"?

New Member
03-09-2018 12:51:44.372 -0500 WARN  CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db
03-09-2018 12:51:44.372 -0500 INFO  CacheManager - Eviction results: count=0, test_count=0, bytes_evicted=0, bytes_needed=15912517632, elapsed_ms=1
03-09-2018 12:51:44.372 -0500 WARN  CacheManager - Unable to evict enough data. Evicted size=0 instead of size=15912517632

Cannot find any documentation of cause or resolution
Can use splunk gui but queries will not run

0 Karma
Highlighted

Re: Why is a single instance of splunk not running query and giving an error "CacheManager - Last run failed to evict requested bytes"?

New Member

never mind .

0 Karma
Highlighted

Re: Why is a single instance of splunk not running query and giving an error "CacheManager - Last run failed to evict requested bytes"?

Esteemed Legend

Don't keep us in suspense, share your solution and then click Accept. Help others learn from your mistakes!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.