limits.conf is not present under /opt/splunk/etc/system/local

prateeksawhney — Tue, 02 Mar 2021 05:41:09 GMT

Hi All,

I need your help urgently, I am facing issue with one of the forwarder as it keeps taking lots of space in /opt directory and due to which sometimes it stops running. Upon checking further I noticed that this directory is taking maximum space.

/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db

On further investigation I came to know that if I do changes in limits.conf file I can limit size of this directory.

But unfortunately I cannot find this file limits.conf under /opt/splunk/etc/system/local.

Please suggest what can I do about it. Any replies to this will be highly appreciated. Also please correct me if I am using a wrong approach here.

Thanks in advance.

Prateek

Re: limits.conf is not present under /opt/splunk/etc/system/local

manjunathmeti — Tue, 02 Mar 2021 07:56:52 GMT

Hi @prateeksawhney,

You need to create new limits.conf file in /opt/splunk/etc/system/local/.
FYI: Default config files exist in /opt/splunk/etc/system/default/ but you should never edit these.

If this reply helps you, an upvote/like would be appreciated.

topic Re: limits.conf is not present under /opt/splunk/etc/system/local in Getting Data In

limits.conf is not present under /opt/splunk/etc/system/local

Re: limits.conf is not present under /opt/splunk/etc/system/local