Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Why does SPLUNK recommend setting the ulimit setti...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A lovely explanation especially for the indexers at What's Your ulimit
It says -
-- Therefore, a super safe ulimit will be 8 x # forwarders to account for the additional file descriptors Splunk will need for reading/writing during indexing/searching. This setting is very important for indexers as we are expecting constant concurrent connections from forwarders.
Now if you have a 1000 forwarders, like us, we can see why the ulimit should be high...
It also says -
-- It doesn’t hurt to remove the hard limit and set ulimit to unlimited… unless there is some kind of file descriptor leak in Splunk. Such a leak can go undetected for a long time and consume more and more resources. We don’t expect this to happen since we do monitor specifically for these types of problems in our longevity tests conducted with 1000 forwarders across 10 indexers over many days with ulimit set at 2048.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunk recommended ulimit is 64000 but what is maximum ulimit ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A lovely explanation especially for the indexers at What's Your ulimit
It says -
-- Therefore, a super safe ulimit will be 8 x # forwarders to account for the additional file descriptors Splunk will need for reading/writing during indexing/searching. This setting is very important for indexers as we are expecting constant concurrent connections from forwarders.
Now if you have a 1000 forwarders, like us, we can see why the ulimit should be high...
It also says -
-- It doesn’t hurt to remove the hard limit and set ulimit to unlimited… unless there is some kind of file descriptor leak in Splunk. Such a leak can go undetected for a long time and consume more and more resources. We don’t expect this to happen since we do monitor specifically for these types of problems in our longevity tests conducted with 1000 forwarders across 10 indexers over many days with ulimit set at 2048.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
