limits.conf is not present under /opt/splunk/etc/system/local

[prateeksawhney]

Hi All,

I need your help urgently, I am facing issue with one of the forwarder as it keeps taking lots of space in /opt directory and due to which sometimes it stops running. Upon checking further I noticed that this directory is taking maximum space.

/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db

On further investigation I came to know that if I do changes in limits.conf file I can limit size of this directory.

But unfortunately I cannot find this file limits.conf under /opt/splunk/etc/system/local. 

Please suggest what can I do about it. Any replies to this will be highly appreciated. Also please correct me if I am using a wrong approach here.

Thanks in advance.

Prateek

[manjunathmeti]

Hi @prateeksawhney,

You need to create new limits.conf file in  /opt/splunk/etc/system/local/. 
FYI: Default config files exist in /opt/splunk/etc/system/default/ but you should never edit these.

If this reply helps you, an upvote/like would be appreciated.