Monitoring Splunk

What is the max value I can set for max_mem_usage_mb based on our system configuration?

paramagurukarth
Builder

We have Splunk 6.1.5 search head systems with large amount of memory (128 GB) and 20 cores. The expected daily log volume is 500GB and the total number of concurrent users is 5. The expected concurrent searches count is approximately 30 for this system.

What is the max_mem_usage_mb value that I can set? Is there any formula to arrive at a safe number? The last thing that I do not want is to face OOM errors by setting large value for this attribute.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How much to assign to max_mem_usage_mb should be based more on the number of results in your searches than on the size of your system. If you find your search results are being truncated then you should increase the value of max_mem_usage_mb. Doubling the value to 400 MB shouldn't harm your system.

---
If this reply helps you, Karma would be appreciated.
0 Karma

pjvarjani
Path Finder

Do we need to set this limit on SH or on indexer?

Thanks

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...