Monitoring Splunk

Does the following notify error cause indexing issues?

New Member

I have a server running Splunk Enterprise 7.2, and we've been having indexing issues the past week. I found the following error in the splunkd logs for max user watches.

0500 ERROR FilesystemChangeWatcher - Error using inotify to watch filesystem -- /proc/sys/fs/inotify/max_user_watches is probably too low.  Falling back to using timeout-based polling.

Could this error be what is causing the indexing issues?

0 Karma


Hii @cjohnson421,

You can follow the below answer, it might help you:-

0 Karma


Not sure about that. but Try to fix the error using the below link:

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!