Indexers Crashing due to Signal 6 Crashing thread: BatchSearch

Available Languages

Updated:September 29, 2026
Document ID:SPLK045605

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

Indexers Crashing due to Signal 6 Crashing thread: BatchSearch

 
 

Investigation

The crash logs are located in $SPLUNK_HOME/var/log/splunk and the contents can be view with either cat or view 

$ cat crash-2022-04-22-15:02:00.log
[build ab7a85abaa98] 2022-04-22 15:02:00
Received fatal signal 6 (Aborted).
 Cause:
   Signal sent by PID 12602 running under UID 0.
 Crashing thread: BatchSearch << This is the crashing thread
 Registers:
    RIP:  [0x00007F2AAF1A299F] gsignal + 271 (libc.so.6 + 0x3799F)
    RDI:  [0x0000000000000002]
    RSI:  [0x00007F2AA8DFD730]
    RBP:  [0x00007F2AAF2F3880]
    RSP:  [0x00007F2AA8DFD730]
    RAX:  [0x0000000000000000]
    RBX:  [0x0000000000000006]
    RCX:  [0x00007F2AAF1A299F]
    RDX:  [0x0000000000000000]
    R8:  [0x0000000000000000]
    R9:  [0x00007F2AA8DFD730]
    R10:  [0x0000000000000008]
    R11:  [0x0000000000000246]
    R12:  [0x0000560E18A907A8]
    R13:  [0x0000560E18A907E8]
    R14:  [0x00000000000000B9]
    R15:  [0x0000000000000000]
    EFL:  [0x0000000000000246]
    TRAPNO:  [0x0000000000000000]
    ERR:  [0x0000000000000000]
    CSGSFS:  [0x002B000000000033]
    OLDMASK:  [0x0000000000000000] OS: Linux
 Arch: x86-64 Backtrace (PIC build):
  [0x00007F2AAF1A299F] gsignal + 271 (libc.so.6 + 0x3799F)
  [0x00007F2AAF18CCF5] abort + 295 (libc.so.6 + 0x21CF5)
  [0x00007F2AAF18CBC9] ? (libc.so.6 + 0x21BC9)
  [0x00007F2AAF19AE56] ? (libc.so.6 + 0x2FE56)
  [0x0000560E182C97F4] _ZN15CsvDataProvider8readRowsEPK16LookupDefinitionb + 420 (splunkd + 0x235E7F4)
  [0x0000560E182C9B65] _ZN15CsvDataProvider12lookupSingleER14UnpackedResultRK17SearchResultsInfoRK16LookupDefinitionPK22LookupProcessorOptions + 69 (splunkd + 0x235EB65)
  [0x0000560E181B65DD] _ZN18LookupDataProvider6lookupERSt6vectorIP15SearchResultMemSaIS2_EERK17SearchResultsInfoR16LookupDefinitionPK22LookupProcessorOptions + 2477 (splunkd + 0x224B5DD)
@@@
"crash-2022-04-22-15:02:00.log" [readonly] 125L, 6630C

Resolution


This issue was solved in 8.2.5 latest version.

Workaround

1. Set the below parameters on each indexers $SPLUNK_HOME/etc/system/local/limits.conf file under lookup stanza.

[lookup]
max_memtable_bytes = 2147483648

Once applying this setting on the indexers a restart of the splunkd service will be required.


2. If the above changes didn't help please try the below settings on all the indexers under $SPLUNK_HOME/etc/system/local/limits.conf file and restart the services same.

[lookup]
enable_splunkd_kv_lookup_indexing = true

 


Limitsconf
Fixed Issues
 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products