mvexpand: output will be truncated at 1600 results due to excessive memory usage. Memory threshold of 500MB has been reached.
How do I increase this to say....4GB (i have 8 in my server)?
I've changed "max_mem_usage_mb = 5000000000" in sudo nano /opt/splunk/etc/system/local/limits.conf
but this hasn't fixed it, also i had to add this to my limits file.
The mvexpand uses it's own stanza to denote memory usage of its'.
[mvexpand]
* This stanza allows for fine tuning of mvexpand search command.
max_mem_usage_mb = <non-negative integer>
* Overrides the default value for max_mem_usage_mb
* See definition in [default] max_mem_usage_mb for more details
* Defaults to 500 (MB)
The mvexpand uses it's own stanza to denote memory usage of its'.
[mvexpand]
* This stanza allows for fine tuning of mvexpand search command.
max_mem_usage_mb = <non-negative integer>
* Overrides the default value for max_mem_usage_mb
* See definition in [default] max_mem_usage_mb for more details
* Defaults to 500 (MB)
changing max_mem_usage_mb to higher value in limits.conf in SHC doesn't seem to work. surprisingly other limits.conf settings are working as expected. just not max_mem_usage_mb for [mvexpand]. any clue?
you may also need to adjust this setting for indexers, too.