I'm getting this error too. WHen logged in as Splunk user i get this:
[code]
echo $JAVA_HOME
/usr/java
java -version
java version "1.8.0_111"
Java(TM) SE Runtime Environment (build 1.8.0_111-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.111-b14, mixed mode)
[/code]
I'm at a loss as to what could be wrong.
... View more
Hmmm...well...
I sorted it out just two hours ago by setting MAX_DAYS_AGO in props.conf on the indexer to 185 (default value is 2000), and so far it seems to be working fine. I believe Splunk tried to index the whole old log from way back and ended up with all of mpool being spent on this.
I'm still not quite sure it works out, but within a few days it i will probably know for sure.
... View more
Did you ever get to solve this issue? I'm experiencing the same thing on our Splunk 6.1.6 installation with a log file at 9+ GB and an mpool of 4GB (appx)
... View more