Splunk Search
Highlighted

Why is the memory usage high on the indexer when running a simple stats count search?

Path Finder

The search index=main | stats count is taking a lot of memory on the indexer when there are lots of events. Isn't the indexer doing an incremental reduce to produce the count? Why would it need a lot of memory?

Highlighted

Re: Why is the memory usage high on the indexer when running a simple stats count search?

Splunk Employee
Splunk Employee

Compare the search mode.
For a basic search like this one, make sure that you are running the search in "fast mode" not in "verbose or smart mode",
It may do a different if you have many automatic fields extractions / lookups.
What is the nature of your data, are they key/values, or do they require complex regexes to parse at search time ?

About the memory map reduce, this would be more relevant if you have several indexers.

0 Karma