03-09-2018 12:51:44.372 -0500 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db
03-09-2018 12:51:44.372 -0500 INFO CacheManager - Eviction results: count=0, test_count=0, bytes_evicted=0, bytes_needed=15912517632, elapsed_ms=1
03-09-2018 12:51:44.372 -0500 WARN CacheManager - Unable to evict enough data. Evicted size=0 instead of size=15912517632
Cannot find any documentation of cause or resolution
Can use splunk gui but queries will not run
Having the same issue, couldn't find the right solution 😞
never mind .
Don't keep us in suspense, share your solution and then click Accept
. Help others learn from your mistakes!