Splunk Search

Why is a single instance of splunk not running query and giving an error "CacheManager - Last run failed to evict requested bytes"?

kmevans
New Member
03-09-2018 12:51:44.372 -0500 WARN  CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db
03-09-2018 12:51:44.372 -0500 INFO  CacheManager - Eviction results: count=0, test_count=0, bytes_evicted=0, bytes_needed=15912517632, elapsed_ms=1
03-09-2018 12:51:44.372 -0500 WARN  CacheManager - Unable to evict enough data. Evicted size=0 instead of size=15912517632

Cannot find any documentation of cause or resolution
Can use splunk gui but queries will not run

0 Karma

ryuj11n
Loves-to-Learn

Having the same issue, couldn't find the right solution 😞

0 Karma

kmevans
New Member

never mind .

0 Karma

woodcock
Esteemed Legend

Don't keep us in suspense, share your solution and then click Accept. Help others learn from your mistakes!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...