Getting Data In

limits.conf is not present under /opt/splunk/etc/system/local


Hi All,

I need your help urgently, I am facing issue with one of the forwarder as it keeps taking lots of space in /opt directory and due to which sometimes it stops running. Upon checking further I noticed that this directory is taking maximum space.

On further investigation I came to know that if I do changes in limits.conf file I can limit size of this directory.
But unfortunately I cannot find this file limits.conf under /opt/splunk/etc/system/local. 
Please suggest what can I do about it. Any replies to this will be highly appreciated. Also please correct me if I am using a wrong approach here.
Thanks in advance.
Labels (1)
0 Karma


Hi @prateeksawhney,

You need to create new limits.conf file in  /opt/splunk/etc/system/local/. 
FYI: Default config files exist in /opt/splunk/etc/system/default/ but you should never edit these.

If this reply helps you, an upvote/like would be appreciated.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.