Hello, We have Splunk 7.1.1 with 16 CPU and 8G physical memory, It's keep shutting down by its self, At the beginning it was every day and the disk was over 80% so we made the frozenTimePeriodInSec=31536000, and that make the disk stable at 66%. The problem was better for few days but then it returned back with message related to the number of search witch is more 5000 , To fix that we run a code to delete the the empty the Dispatch every 1hour. That's made the search more faster but didn't fix the problem. The memory usage is always more than 70% now and it's very unstable (the Cpu usage is good not more 20%).
... View more