Monitoring Splunk

How to change limits.conf in order to resolve "mvexpand: output will be truncated at 1600 results due to excessive memory usage" error?

arrowecssupport
Communicator
mvexpand: output will be truncated at 1600 results due to excessive memory usage. Memory threshold of 500MB has been reached.

How do I increase this to say....4GB (i have 8 in my server)?

I've changed "max_mem_usage_mb = 5000000000" in sudo nano /opt/splunk/etc/system/local/limits.conf

but this hasn't fixed it, also i had to add this to my limits file.

0 Karma
1 Solution

somesoni2
Revered Legend

The mvexpand uses it's own stanza to denote memory usage of its'.

[mvexpand]
* This stanza allows for fine tuning of mvexpand search command.

max_mem_usage_mb = <non-negative integer>
* Overrides the default value for max_mem_usage_mb
* See definition in [default] max_mem_usage_mb for more details
* Defaults to 500 (MB)

View solution in original post

0 Karma

somesoni2
Revered Legend

The mvexpand uses it's own stanza to denote memory usage of its'.

[mvexpand]
* This stanza allows for fine tuning of mvexpand search command.

max_mem_usage_mb = <non-negative integer>
* Overrides the default value for max_mem_usage_mb
* See definition in [default] max_mem_usage_mb for more details
* Defaults to 500 (MB)

View solution in original post

0 Karma

nm1984splunk
New Member

changing max_mem_usage_mb to higher value in limits.conf in SHC doesn't seem to work. surprisingly other limits.conf settings are working as expected. just not max_mem_usage_mb for [mvexpand]. any clue?

0 Karma

evilgeorge
Engager

you may also need to adjust this setting for indexers, too.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!