Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Why is the Memory Tracker not working as expec...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunkers,
We have set search_process_memory_usage_threshold to 3GB, but noticed that searches are terminated when the usage reaches much higher values, example below.
Is this expected behaviour, or is there any other parameter to be enabled make it work better?
09-13-2018 10:59:00.013 +1000 WARN SearchProcessMemoryTracker - Dispatch Command: The search processs with sid=XXXX was forcefully terminated because its physical memory usage (5626.160000 MB) has exceeded the 'search_process_memory_usage_threshold' (3000.000000 MB) setting in limits.conf.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Most likely the search's memory passed the threshold very quickly in between memory tracker doing its periodic checks. At a glance of the available limits.conf settings, I don't see anything that would let you tune the polling interval of memory tracker.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks traxxasbreaker
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Most likely the search's memory passed the threshold very quickly in between memory tracker doing its periodic checks. At a glance of the available limits.conf settings, I don't see anything that would let you tune the polling interval of memory tracker.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks @traxxasbreaker.
Do we get an option to configure this period for checks?
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
