Getting Data In

limits.conf is not present under /opt/splunk/etc/system/local

prateeksawhney
Explorer

Hi All,

I need your help urgently, I am facing issue with one of the forwarder as it keeps taking lots of space in /opt directory and due to which sometimes it stops running. Upon checking further I noticed that this directory is taking maximum space.

/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db
 
On further investigation I came to know that if I do changes in limits.conf file I can limit size of this directory.
But unfortunately I cannot find this file limits.conf under /opt/splunk/etc/system/local. 
 
Please suggest what can I do about it. Any replies to this will be highly appreciated. Also please correct me if I am using a wrong approach here.
 
Thanks in advance.
Prateek
Labels (1)
0 Karma

manjunathmeti
Champion

Hi @prateeksawhney,

You need to create new limits.conf file in  /opt/splunk/etc/system/local/. 
FYI: Default config files exist in /opt/splunk/etc/system/default/ but you should never edit these.

If this reply helps you, an upvote/like would be appreciated.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!