I'm getting this error too. WHen logged in as Splunk user i get this: [code] echo $JAVA_HOME /usr/java java -version java version "1.8.0_111" Java(TM) SE Runtime Environment (build 1.8.0_111-b14) Java HotSpot(TM) 64-Bit Server VM (build 25.111-b14, mixed mode) [/code] I'm at a loss as to what could be wrong. ... View more

Hi The mpool messages are related to the mpool lines and relates to the memory used by Splunk Indexer pipeline. The value is based the capacity value which the indexers memory limit. see here: http://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Aboutmetricslog (search mpool) In the props.conf you can adjust the TRUNCATE = xxx ( default is 10000 bytes) and MAX_EVENTS = xxx (default is 256 lines which is the max number of lines per event) Try using this search to determine the best value for TRUNCATE: sourcetype=mysourcetype | eval length=len(_raw) | stats max(length) perc95(length) max(linecount) perc95(linecount)  Hope this helps to clarify and sort the issues. Cheers ... View more