After upgrading from 6.6->7.2.4, we started receiving an alert daily that a nightly job was taking memory exceeding our set threshold for a single search. The search used a collect command taking a large index, filtering to a subset of messages, and then collect the results into a smaller index (a 2 line search). It consistently pulls in around 100,000 logs, but takes between 4 minutes and several hours to run - much to our confusion. The longer ones are taking up all the available memory and crashing Splunk. This only started happening after the upgrade. Any thoughts appreciated! Thanks
