click anywhere on the screen and type: thisisunsafe It will let continue to the page. ... View more

Installed on 10.11 without any xcode. Hit the DeRez requires dev tools dialogue. Hoping to avoid installing xcode and more heft/cruft/config, but also reluctant to fake the path as per the above solution as it means my notes on recovering the solution become pages long. Found an alternate temporary solution; just Install the command line tools http://osxdaily.com/2014/02/12/install-command-line-tools-mac-os-x/ Hopefully Splunk will find it! ... View more

The initial problem was the indexers were crashing. Splunk determined it was a bug a a fix was released as part of 6.0.3 I believe. The cause was an error with memory mapping between Splunk, the OS and VMware. ... View more

This worked, though I will forward this along to Splunk to see if they can integrate it into the TA. I commented out the LINE_BREAKER and used the above BREAK_ONLY_BEFORE line above in a props.conf saved in the local directory of the Splunk Add-on for McAfee app. ... View more

Are you running Splunk on linux (RHEL)? How much memory do you have on the server? Have you looked at this: http://docs.splunk.com/Documentation/Splunk/6.2.1/ReleaseNotes/SplunkandTHP This may cause Splunk to under perform with THP enabled and even not release memory back to the server. The linux out of memory manager can also start to kill splunkd if it consumes too much memory. http://www.oracle.com/technetwork/articles/servers-storage-dev/oom-killer-1911807.html ... View more

I have the same problem. Rhel 5.8 - 32GB ram. Memory is consumed and swap too. Seeing "sar -r" after hard reboot reveals the same issue. My sar config pulls data each minute. No cpu issue, no disk io issue (local disk raid 10). Splunk v6.0.5. It only happens to me after a couple weeks of keeping Splunkd running. Seems like a memory leak to me. Splunk support wants a diag but it's pointless right now. The system is still healthy. All I see at the time was lots of search requests from search head to indexer. ... View more

I had a similar error on startup. I looked in the splunk logs - %ProgramFiles%\SplunkUniversalForwarder\var\log\splunk\splunkd.log and it turned out to be a completely different issue. It had to do with corrupt permissions on the forwarder input.config files. Just as a pointer to maybe start from the log files and go from there. Hope this helps someone. ... View more

Your ulimits are not set correctly, or are using the system defaults. As a result, splunkd is likely using more memory than allowed or available, so the kernel kills the process in order to protect itself. ... View more

Thanks... I was even doing searches for it, but couldn't find it! ... View more