Splunk Search

Why is a single instance of splunk not running query and giving an error "CacheManager - Last run failed to evict requested bytes"?

kmevans
New Member
03-09-2018 12:51:44.372 -0500 WARN  CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db
03-09-2018 12:51:44.372 -0500 INFO  CacheManager - Eviction results: count=0, test_count=0, bytes_evicted=0, bytes_needed=15912517632, elapsed_ms=1
03-09-2018 12:51:44.372 -0500 WARN  CacheManager - Unable to evict enough data. Evicted size=0 instead of size=15912517632

Cannot find any documentation of cause or resolution
Can use splunk gui but queries will not run

0 Karma

ryuj11n
Loves-to-Learn

Having the same issue, couldn't find the right solution 😞

0 Karma

kmevans
New Member

never mind .

0 Karma

woodcock
Esteemed Legend

Don't keep us in suspense, share your solution and then click Accept. Help others learn from your mistakes!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...