Monitoring Splunk

Does the following notify error cause indexing issues?

cjohnson421
New Member

I have a server running Splunk Enterprise 7.2, and we've been having indexing issues the past week. I found the following error in the splunkd logs for max user watches.

0500 ERROR FilesystemChangeWatcher - Error using inotify to watch filesystem -- /proc/sys/fs/inotify/max_user_watches is probably too low.  Falling back to using timeout-based polling.

Could this error be what is causing the indexing issues?

0 Karma

MoniM
Communicator

Hii @cjohnson421,

You can follow the below answer, it might help you:-
https://answers.splunk.com/answers/147511/filesystemchangewatcher-error-getting-attributes-of-path.h...

0 Karma

vishaltaneja070
Motivator

Not sure about that. but Try to fix the error using the below link:
https://github.com/kubernetes/kubernetes/issues/46230

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...