I changed ulimits to 64000 ulimit -n 64000 and I realized I had THP still enabled on the CentOS 7 VM it is on so i disabled it and rebooted the VM. vim /etc/default/grub  added transparent_hugepage = never echo 'never' > /sys/kernel/mm/transparent_hugepage/enabled echo 'never' > /sys/kernel/mm/transparent_hugepage/defrag I also enabled auto start for splunk. /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 1 I then rebooted. reboot After doing that and the reboot the searches started to work correctly and stopped erroring out. Hopefully this thread can help someone else who has this weird problem! ... View more