Should we have 'max_content_length' setting in server.conf consistent across Indexers and Search Heads?

[anoopambli]

Should we have 'max_content_length' setting in server.conf consistent across Indexers and Search Heads? I see a smaller value in SH and higher value in Indexer. What would be the impact with the current setting?

[sloshburch]

Hmm. Interesting. Is there anything in your config that explains why it was increased? I've never played with that setting personally and unless you have been advised by PS or by Support, I'd question why it was changed. It does seem fishy that it wouldn't be the same across the environment.

Is your SH higher or lower than the Indexers? What values are set currently?

For lazyness, here's what I'm sure folks are clicking into in the docs:

[httpServer]
max_content_length = <int>
* Measured in bytes
* HTTP requests over this size will rejected.
* Exists to avoid allocating an unreasonable amount of memory from web
  requests
* Defaulted to 2147483648 or 2GB
* In environments where indexers have enormous amounts of RAM, this
  number can be reasonably increased to handle large quantities of
  bundle data.

[Pawlub1]

Hi all,

I need to update the max_content_length value in server.conf file across all indexers. 

I thought we are doing this via the Cluster Master, but unfortunately the server.conf files are not getting updated on the search peers. 

/Cheers

[PickleRick]

It's not about the file itself but about the location of the file. Cluster manager pushes apps (which can contain server.conf) but can't touch files in system directory.

Read

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Managecommonconfigurations

and

https://docs.splunk.com/Documentation/Splunk/latest/admin/Wheretofindtheconfigurationfiles

And next time, please post a question in a new thread instead of dighing up a 5-years-old one

[Pawlub1]

Hi PickleRick,

So I did as the procedure stated, but it threw the following error as we are still using Master-Apps.

I moved the server.conf to _cluster/local directory in Master-Apps and hopefully these indexers are updated. 

Error message:

"Populated manager-apps location found, but master-apps is also populated. There can be only one. This must be fixed before continuing"

After moving the server.conf file to folder in Master-Apps folder the error stopped.

Thanks!