Hi,
since we upgraded to Splunk 4.3 from 4.2 we keep seeing this WARN coming up:
01-13-2012 14:49:35.988 +0100 WARN ProcessDispatchedSearch - PROCESS_SEARCH src/system-alloc.cc:423] SbrkSysAllocator failed.
We see this popping also in Splunkd.log before the former message kicks in:
01-13-2012 14:44:05.902 +0100 WARN DistributedBundleReplicationManager - bundle replication to 2 peer(s) took too long (13054ms), bundle file size=28390KB, replication_id=1326462232
We run Splunk 64bit on RHEL5 64bit Linux.
UPDATE: The server seems to allocate large amounts of memory, up to 10Gb and lots of swap space too. Is this some memory bug?
... View more