Monitoring Splunk

How to change limits.conf in order to resolve "mvexpand: output will be truncated at 1600 results due to excessive memory usage" error?

arrowecssupport
Communicator
mvexpand: output will be truncated at 1600 results due to excessive memory usage. Memory threshold of 500MB has been reached.

How do I increase this to say....4GB (i have 8 in my server)?

I've changed "max_mem_usage_mb = 5000000000" in sudo nano /opt/splunk/etc/system/local/limits.conf

but this hasn't fixed it, also i had to add this to my limits file.

0 Karma
1 Solution

somesoni2
Revered Legend

The mvexpand uses it's own stanza to denote memory usage of its'.

[mvexpand]
* This stanza allows for fine tuning of mvexpand search command.

max_mem_usage_mb = <non-negative integer>
* Overrides the default value for max_mem_usage_mb
* See definition in [default] max_mem_usage_mb for more details
* Defaults to 500 (MB)

View solution in original post

0 Karma

somesoni2
Revered Legend

The mvexpand uses it's own stanza to denote memory usage of its'.

[mvexpand]
* This stanza allows for fine tuning of mvexpand search command.

max_mem_usage_mb = <non-negative integer>
* Overrides the default value for max_mem_usage_mb
* See definition in [default] max_mem_usage_mb for more details
* Defaults to 500 (MB)
0 Karma

nm1984splunk
New Member

changing max_mem_usage_mb to higher value in limits.conf in SHC doesn't seem to work. surprisingly other limits.conf settings are working as expected. just not max_mem_usage_mb for [mvexpand]. any clue?

0 Karma

evilgeorge
Explorer

you may also need to adjust this setting for indexers, too.

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...