You can add SWAP memory to prevent OOM for huge search/exports.   ... View more

This is not Splunk specific issue. You can find the answer here: https://stackoverflow.com/questions/9843178/linux-capabilities-setcap-seems-to-disable-ld-library-path Generally "LD_LIBRARY_PATH=/opt/splunk/lib" get's ignored after setcap for security reasons.   Workaround is via adding Splunk libraries globally, obviously with downsides of it own   $ sudo sh -c "echo \"/opt/splunk/lib\" >> /etc/ld.so.conf.d/splunk.conf" $ sudo ldconfig     ... View more