Splunk Search

Why is the memory usage high on the indexer when running a simple stats count search?

Path Finder

The search index=main | stats count is taking a lot of memory on the indexer when there are lots of events. Isn't the indexer doing an incremental reduce to produce the count? Why would it need a lot of memory?

Splunk Employee
Splunk Employee

Compare the search mode.
For a basic search like this one, make sure that you are running the search in "fast mode" not in "verbose or smart mode",
It may do a different if you have many automatic fields extractions / lookups.
What is the nature of your data, are they key/values, or do they require complex regexes to parse at search time ?

About the memory map reduce, this would be more relevant if you have several indexers.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...