Monitoring Splunk

How to change limits.conf in order to resolve "mvexpand: output will be truncated at 1600 results due to excessive memory usage" error?

arrowecssupport
Communicator
mvexpand: output will be truncated at 1600 results due to excessive memory usage. Memory threshold of 500MB has been reached.

How do I increase this to say....4GB (i have 8 in my server)?

I've changed "max_mem_usage_mb = 5000000000" in sudo nano /opt/splunk/etc/system/local/limits.conf

but this hasn't fixed it, also i had to add this to my limits file.

0 Karma
1 Solution

somesoni2
Revered Legend

The mvexpand uses it's own stanza to denote memory usage of its'.

[mvexpand]
* This stanza allows for fine tuning of mvexpand search command.

max_mem_usage_mb = <non-negative integer>
* Overrides the default value for max_mem_usage_mb
* See definition in [default] max_mem_usage_mb for more details
* Defaults to 500 (MB)

View solution in original post

0 Karma

somesoni2
Revered Legend

The mvexpand uses it's own stanza to denote memory usage of its'.

[mvexpand]
* This stanza allows for fine tuning of mvexpand search command.

max_mem_usage_mb = <non-negative integer>
* Overrides the default value for max_mem_usage_mb
* See definition in [default] max_mem_usage_mb for more details
* Defaults to 500 (MB)
0 Karma

nm1984splunk
New Member

changing max_mem_usage_mb to higher value in limits.conf in SHC doesn't seem to work. surprisingly other limits.conf settings are working as expected. just not max_mem_usage_mb for [mvexpand]. any clue?

0 Karma

evilgeorge
Explorer

you may also need to adjust this setting for indexers, too.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...