Deployment Architecture

How many file descriptors and threads does Splunk use?


I've seen a lot of discussion and recommendations on the number of file descriptors that should be made available to a Splunk instance, but should that vary depending on the primary function of the instance? Does a Search Head require more than a Universal Forwarder for instance?

Similarly for threads, which I assume should be higher for a busy Search Head or Indexer, but not so high for a Deployment Server or License Master - is that correct?

Is there any way to look at a running instance and determine how much of these resources are in use?

Should I have a standard base configuration for all instances or should it vary depending on the function/overall workload?

Splunk Employee
Splunk Employee

You can install the splunk on splunk app. This app has a feature which allows you to view file descriptor usage across multiple instances of splunk. As a general best practice you should try to have all instances of splunk have at least 8192 open file descriptors. Two good posts I often refer people to are the following

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...