@dsilva, do you know when we can expect an update to the app to use the HEC instead of inputs? Does the current app with with the data ingested from the HEC? ... View more

We did not have any hardware issues or cpu / memory problems on the server just that the process I mentioned hanged and led to the problems I described. Splunk is still running but cannot be contacted. And it seems to occur on our newer search head running 4.3 ... View more

This might be a different problem, I would suggest that you ask a new question. Some of the stuff we'll want to find out : Does this happen consistently and always with the same bucket? How much physical and virtual memory is available on your system at the time that you get the error? ... View more