I'm using the 'Network Toolkit' (v1.5.1) (@LukeMurphey ) to schedule regular ping tests against about 200 hosts every few minutes. This works really well, but after about a week the pings stop working and I can see this in the logs:   2021-06-15 08:07:12 , 023 ERROR [ Errno 12 ] Cannot allocate memory Traceback ( most recent call last ) : File " /opt/splunk/etc/apps/network_tools/bin/ping.py ", line 203 , in run_ping results = ping_all ( dest , count=runs , logger=self.logger , callback=output_result_callback ) File " /opt/splunk/etc/apps/network_tools/bin/network_tools_app/ping_network.py ", line 54 , in ping_all _ , return_code , result = ping ( str ( dest_network.network_address ), count , index=index , logger=logger ) File " /opt/splunk/etc/apps/network_tools/bin/network_tools_app/__init__.py ", line 416 , in ping raise exception OSError: [ Errno 12 ] Cannot allocate memory Any ideas how to fix this? Thanks   Ian     ... View more

I'm trying to get the results of a script which outputs a largeish table into splunk, but something isn't right in the way that the results are being split into different events. I want the complete table (about 100 lines) to be contained in one event so I can do magic with a multikv command.  At the moment, each run is spilt across events - some are 60+ lines, some a single lines and some between those.   The actual script is being run on a search head, which has all it's outputs being forwarded to the indexer. The script should starts output with the literal characters BOF and end EOF - this works fine when run directly.  Config files below: inputs.conf: [script://$SPLUNK_HOME/etc/apps/stem-snmp/bin/stem-snmptable.sh] disabled=false index=main interval=60 sourcetype=stem-snmptable props.conf: [stem-snmptable] DATETIME_CONFIG = CURRENT EVENT_BREAKER_ENABLE = true EVENT_BREAKER = "(EOF)" NO_BINARY_CHECK = true SHOULD_LINEMERGE = true category = Custom pulldown_type = 1 disabled = false   On the indexer  I have the following in a custom app local folder (is this right?)   [stem-snmptable] NO_BINARY_CHECK = true SHOULD_LINEMERGE = true category = Custom pulldown_type = 1 disabled = false MUST_BREAK_AFTER = "(EOF)" MUST_NOT_BREAK_AFTER = "(BOF)" DATETIME_CONFIG = CURRENT   So, where have I gone wrong. Do I need to put the indexer props.conf in a different location? Have I misunderstood the break and linemerge configs?   Any help much appreciated.     ... View more