|
Running 4.0.9, about one a day I start getting this error in the log for a particular search. The only way to resolve is to restart Splunk. Does anybody know this means, why it happens, and how to possibly resolve. Here is the Error WARN SavedSplunker - Max alive instance_count=1 reached for savedsearch_ident=[name of saved search] Thanks.. |
|
This was a bug in 4.0.9 and earlier versions. SPL-28999 This bug was caused by the scheduler not handling the following two cases properly: (1) the user that owns the search has reached either disk usage or max concurrent searches (2) the system has reached the maximum number of allowed concurrent searches The searches which were attempted to run while any of the above conditions was true will NOT be ran until restart, even if the condition that caused the failure is cleared. (for example the user is not using the max disk quota anymore) Currently besides restart, the only work around is to increase the quotas in limits.conf. So far this condition has been observed at clients that have reached the disk quota limit, their scheduled searches generate working sets in excess of 30GB. The fix for 4.0.10 is to make the scheduler recognize the cleared condition and resume execution of searches at that time. |
