All Apps and Add-ons
Highlighted

Counting open files with lsof in Unix app

Communicator

I need a way to determine how many files a particular user has open at any given time. This data exists in the output of the lsof data in the *nix app. BUt since it's one big field, I am unsure of how to parse it to get counts of files by user. Any ideas?

0 Karma
Highlighted

Re: Counting open files with lsof in Unix app

Splunk Employee
Splunk Employee

Did you try:

index=os sourcetype=lsof | multikv

View solution in original post

Highlighted

Re: Counting open files with lsof in Unix app

Communicator

Nice! Sometimes the simplest solution evades me. Thanks!

0 Karma
Highlighted

Re: Counting open files with lsof in Unix app

New Member

what is the maximum ulimit is splunk, by default minimum is 64000. anyone please let me know the maximum ulimit setting?

0 Karma