Deployment Architecture

How many file descriptors and threads does Splunk use?

mctester
Communicator

I've seen a lot of discussion and recommendations on the number of file descriptors that should be made available to a Splunk instance, but should that vary depending on the primary function of the instance? Does a Search Head require more than a Universal Forwarder for instance?

Similarly for threads, which I assume should be higher for a busy Search Head or Indexer, but not so high for a Deployment Server or License Master - is that correct?

Is there any way to look at a running instance and determine how much of these resources are in use?

Should I have a standard base configuration for all instances or should it vary depending on the function/overall workload?

kserra_splunk
Splunk Employee
Splunk Employee

You can install the splunk on splunk app. This app has a feature which allows you to view file descriptor usage across multiple instances of splunk. As a general best practice you should try to have all instances of splunk have at least 8192 open file descriptors. Two good posts I often refer people to are the following

http://blogs.splunk.com/2011/11/21/whats-your-ulimit/
http://answers.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...