Counting open files with lsof in Unix app

[timmy13]

I need a way to determine how many files a particular user has open at any given time. This data exists in the output of the lsof data in the *nix app. BUt since it's one big field, I am unsure of how to parse it to get counts of files by user. Any ideas?

[harish_l]

what is the maximum ulimit is splunk, by default minimum is 64000. anyone please let me know the maximum ulimit setting?

[araitz · Accepted solution]

Did you try:

index=os sourcetype=lsof | multikv

[timmy13]

Nice! Sometimes the simplest solution evades me. Thanks!