今天处理了一个splunk 内存不足的case:
Your search has been terminated. This is most likely due to an out of memory condition. Either edit your search to reduce memory requirements or contact your Splunk administrator
Refer to doc : Troubleshoot high memory usage - Splunk Documentation
提供了检查search size 的语句:
|