Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: Why are our REST limits so low, how do we chan...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Some of our Deployment Servers going offline with these events flooding SplunkD.log:
WARN HttpListener - Can't handle request for /services/broker/connect/<GUID>/<Server>/271043/windows-x64/<port>, max thread limit for REST HTTP server is 2728, threads already in use is 2728
The servers eventually show as Offline and when they're rebooted they resume working for a while.
Why is the limit so low? I found in the documentation where this is addressed in 6.3 (http://docs.splunk.com/Documentation/Splunk/6.3.0/Troubleshooting/HTTPthreadlimitissues) but can't find where to address this in 6.2.6, and we're not quite ready to upgrade.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The workaround should be the same for 6.2.6 as 6.3.0. The thread limit was introduced in 6,0.0 so the calculation and override are the same for all 6.x.x versions to the present.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have same issue except I have Splunk Version 6.3.0 loaded on windows. The workaround is for Linux users. Is there a workaround for windows I wonder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The workaround should be the same for 6.2.6 as 6.3.0. The thread limit was introduced in 6,0.0 so the calculation and override are the same for all 6.x.x versions to the present.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, I've set it to -1 on the server that was having issues and since haven't seen any errors.
Accelerating Observability as Code with the Splunk AI Assistant
Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...
Congratulations to the 2025-2026 SplunkTrust!
