topic Re: need to check where is ulimit value in Monitoring Splunk

need to check where is ulimit value

Praz_123 — Wed, 12 Feb 2025 07:14:14 GMT

How can i find ulimit value/status for all server in monitoring console.

Re: need to check where is ulimit value

livehybrid — Wed, 19 Feb 2025 21:44:30 GMT

You may be able to create a simple app to push out to your instances which runs a modular input to capture this, but in terms of out-of-the-box functionality, unfortunately this isnt available at the moment.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: need to check where is ulimit value

kiran_panchavat — Wed, 12 Feb 2025 17:09:18 GMT

@Praz_123

There are a few ways you can check your ulimit settings.

The monitoring console includes a health check for ulimits. See https://docs.splunk.com/Documentation/Splunk/9.4.0/DMC/Customizehealthcheck

Each time the Splunk Enterprise service is started or restarted, it will report on the ulimits. You can search the internal logs for the report using:

Re: need to check where is ulimit value

SanjayReddy — Wed, 12 Feb 2025 18:18:48 GMT

Hi @Praz_123

you can use rest call in moniotring console for getting inforamtion for SH and Indexers information

| rest splunk_server=<server name> services/server/sysinfo | eval "RAM GB"=round(physicalMemoryMB/1024)
| table os_name os_build cpu_arch "RAM GB" numberOfCores numberOfVirtualCores transparent_hugepages.defrag transparent_hugepages.enabled transparent_hugepages.effective_state ulimits*
| rename os_name as "Opeating System" os_build as "OS Build" cpu_arch as "OS Arch" numberOfCores as "Physical Cores" numberOfVirtualCores as "Virtual Cores" transparent_hugepages.defrag as "THP Defrag" transparent_hugepages.enabled as "THP enabled"

you can use following rest call to run in CLI as well

curl -k -u admin:changeme https://localhost:8089/services/server/sysinfo

Re: need to check where is ulimit value

livehybrid — Wed, 12 Feb 2025 19:41:21 GMT

well TIL… thanks @SanjayReddy

Re: need to check where is ulimit value

gcusello — Thu, 13 Feb 2025 07:33:36 GMT

Hi @Praz_123 ,

if you'r speaking of ulimit of Splunk Servers, you can use the Monitoring Console health Check.

If you're speking of Forwarders (Universal or Heavy it's the same), there's no direct solution and you should use the solution from @livehybrid: a shall script input (to insert in a custom add-on) that extract this value and sends it to the Indexers.

Ciao.

Giuseppe