Deployment Architecture

Cannot set maxThreads and maxSockets to -1 in server.conf despite what server.conf.spec says

tlow
Explorer

With version 6.0 these parameters, it restricted the amount of file open. when i changed server.conf to

[httpServer]
maxThreads = -1
maxSockets = -1

Splunk unable to parse the negative number, what is correct syntax to "no limit will be enforced"

maxThreads =
* Number of threads that can be used by active HTTP transactions.
This can be limited to constrain resource usage.
* If set to 0 (the default) a limit will be automatically picked
based on estimated server capacity.
* If set to a negative number, no limit will be enforced.

maxSockets =
* Number of simultaneous HTTP connections that we'll accept simultaneously.
This can be limited to constrain resource usage.
* If set to 0 (the default) a limit will be automatically picked
based on estimated server capacity.
* If set to a negative number, no limit will be enforced.

hexx
Splunk Employee
Splunk Employee

Clarified the stanza in the question.

0 Karma

jrodman
Splunk Employee
Splunk Employee

For clarity, dumbo me, what stanza are these in?

0 Karma

hexx
Splunk Employee
Splunk Employee

"-1" is the correct setting for an unbounded maxThreads or maxSockets, but it was broken for a bit due to bug SPL-82389.

This has been resolved in Splunk Enterprise 6.0.4, which was released today.

jgedeon120
Contributor

The known issues for 6.0.4 is still showing this issue, SPL-82389, as active and not fixed in 6.0.4.

0 Karma

jrodman
Splunk Employee
Splunk Employee

I question the use of unbounded values here, though.
If your system can't operate inside a thousand or so simultaneous sockets/requests then it's just going to run out of system memory, most likely, and fall over.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Any reasonably large number such as 1000000 should work around this, effectively imposing no limit.

0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...