Knowledge Management

max_content_length across IDx SH Cluster


Should we have 'max_content_length' setting in server.conf consistent across Indexers and Search Heads? I see a smaller value in SH and higher value in Indexer. What would be the impact with the current setting?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Hmm. Interesting. Is there anything in your config that explains why it was increased? I've never played with that setting personally and unless you have been advised by PS or by Support, I'd question why it was changed. It does seem fishy that it wouldn't be the same across the environment.

Is your SH higher or lower than the Indexers? What values are set currently?

For lazyness, here's what I'm sure folks are clicking into in the docs:

max_content_length = <int>
* Measured in bytes
* HTTP requests over this size will rejected.
* Exists to avoid allocating an unreasonable amount of memory from web
* Defaulted to 2147483648 or 2GB
* In environments where indexers have enormous amounts of RAM, this
  number can be reasonably increased to handle large quantities of
  bundle data.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>