Hi
The mpool messages are related to the mpool lines and relates to the memory used by Splunk Indexer pipeline. The value is based the capacity value which the indexers memory limit.
see here: http://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Aboutmetricslog (search mpool)
In the props.conf you can adjust the TRUNCATE = xxx ( default is 10000 bytes) and MAX_EVENTS = xxx (default is 256 lines which is the max number of lines per event)
Try using this search to determine the best value for TRUNCATE:
sourcetype=mysourcetype | eval length=len(_raw) | stats max(length) perc95(length) max(linecount) perc95(linecount)
Hope this helps to clarify and sort the issues.
Cheers
... View more