Accelerated Data models causing OOMS

Available Languages

Updated:September 29, 2026
Document ID:SPLK047304

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Enterprise

Description

Accelerated Data models in  Splunk_SA_CIM app are unscoped to specifc indexes, causing OOMS ( out of memory errors)


Investigation

1. Search for a similar error, by entering a similar query to this:

index=_internal source=*splunkd.log ERROR OOM
OOM killed sh-i-xxxxxxxxxxxxxxxxxxx.splunkcloud.com kernel: [29804943.581539] Memory cgroup out of memory: Killed process 3719718 (splunkd) total-vm:20904988kB, anon-rss:17028044kB, file-rss:32264kB, shmem-rss:0kB, UID:800 pgtables:40448kB oom_score_adj:700

Resolution

  1. In Splunk Web, access the CIM Setup page:
    • Select Apps > Manage Apps and then click Set up in the row for Splunk Common Information Model.
    • Access the setup page directly by going to https://<URL of your Splunk deployment>/en-US/app/search/cim_setup.
  2. Select the data model to modify.
  3. In Indexes whitelist, type the index that the data model should search. Type the names of indexes that are defined only on indexers.
  4. Click Save.

CIM Setup

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products